DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Description
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Published:
2026-07-28
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Schreibfaul1 | Esp32-audioi2s | 80% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Remediation
No vendor fix or workaround currently provided.
OpenCVE Recommended Actions
- Upgrade ESP32‑audioI2S to the latest released version that includes a fix for the heap‑based buffer overflow (consult the library changelog to confirm the patch).
- If an upgrade is not feasible, disable the ID3 tag parsing routine or replace it with a custom implementation that validates input lengths before writing to memory.
- Implement input validation to reject or sanitize ID3 tag values exceeding predefined limits, and use safe string functions such as snprintf instead of unbounded appendf().
Generated by OpenCVE AI on August 1, 2026 at 00:42 UTC.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
No reference.
History
Sat, 01 Aug 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Heap‑Based Buffer Overflow in ESP32‑audioI2S ID3 Tag Parsing Function |
Fri, 31 Jul 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-122 | |
| References |
|
|
| Metrics |
cvssV3_1
|
Fri, 31 Jul 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf() to write formatted strings into ps_ptr heap buffer without length validation. Successful exploitation allows attackers to execute arbitrary code, leak sensitive memory data, cause device crash, or escalate privileges via a crafted malicious audio file. | DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. |
| References |
|
Thu, 30 Jul 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Schreibfaul1
Schreibfaul1 esp32-audioi2s |
|
| Vendors & Products |
Schreibfaul1
Schreibfaul1 esp32-audioi2s |
Tue, 28 Jul 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-122 | |
| Metrics |
cvssV3_1
|
Tue, 28 Jul 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf() to write formatted strings into ps_ptr heap buffer without length validation. Successful exploitation allows attackers to execute arbitrary code, leak sensitive memory data, cause device crash, or escalate privileges via a crafted malicious audio file. | |
| References |
|
MITRE
Status: REJECTED
Assigner: mitre
Published:
Updated: 2026-07-31T14:34:20.551Z
Reserved: 2026-06-07T00:00:00.000Z
Link: CVE-2026-51273
Vulnrichment
Updated:
NVD
Status : Rejected
Published: 2026-07-28T17:16:46.540
Modified: 2026-07-31T15:16:31.840
Link: CVE-2026-51273
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-01T00:45:03Z
Weaknesses
No weakness.