CVE-2026-51260

Unsafe fixed-size memcpy operation in AudioBuffer::writeSpace of schreibfaul1 ESP32-audioI2S 3.4.5 allows remote heap buffer overflow. The code copies a full UINT16MAX bytes without validating destination available space, causing out-of-bounds memory write...

CVE-2026-51259

Unchecked unsigned integer overflow in buffer size calculation in schreibfaul1 ESP32-audioI2S 3.4.5 leads to undersized PSRAM buffer allocation. Subsequent normal audio buffer read and write operations cause heap out-of-bounds access, memory corruption, denial of service, and potential code...

CVE-2026-51261

The CVE-2026-51261 entry concerns missing mutex synchronization in AudioBuffer::freeSpace() of schreibfaul1 ESP32-audioI2S 3.4.5, causing a race between concurrent tasks. The function computes available buffer space without protecting shared read/write pointers, returning an incorrectly large val...

CVE-2026-51274

CVE-2026-51274 affects schreibfaul1 ESP32-audioI2S 3.4.5. The vulnerability is a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser within audiolib, caused by missing bounds validation on attacker-controlled frame size and improper memory access during lyric parsing. Impact i...