CVE-2026-51270

Description

schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the htmlToUTF8() HTML entity decoding function. The function parses attacker-controlled malicious HTML entities and uses memmove and memcpy to rearrange string content without validating buffer remaining size and boundary limits. Crafted oversized HTML entity strings can trigger heap out-of-bounds write, allowing remote code execution, memory information leakage, service crash or privilege escalation.

References

• https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51270
• https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/Audio.cpp