CVE-2026-51263
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Jul 28, 2026
Vendor
unknown
Description
schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openai_speech function in the Audio library manually constructs JSON request bodies and HTTP request headers by directly concatenating externally controllable input and instructions strings without effective length restriction and boundary validation. An unauthenticated remote attacker can send oversized malicious string data to trigger a heap buffer overflow during string splicing, resulting in memory corruption.