CVE-2026-51254

schreibfaul1 ESP32-audioI2S v3.4.5 has an integer underflow vulnerability in the MP3Decoder::GetBits function of the MP3 decoder due to unchecked bit reading operations. The lack of validation on the nBits parameter causes the cachedBits counter to underflow to negative values, leading to invalid...

CVE-2026-51254

Concrete details found: ESP32-audioI2S v3.4.5 MP3 decoder MP3Decoder::GetBits() has an unchecked nBits read, causing an integer underflow of cachedBits. This can lead to invalid bitstream parsing, app crash, or arbitrary code execution via a crafted MP3 file.