{"uuid": "0b0df523-fabd-43bb-a9c6-19e3ecfb696a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51272", "type": "seen", "source": "https://gist.github.com/programmervuln/5d1388bb85dfaf2e7e2700c5a2bceef5", "content": "original vulnerable code link: https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/Audio.cpp\nCVE-2026-51272 Full MITRE CVE Application Document\n1. Affected Product\nschreibfaul1 ESP32-audioI2S\n2. Affected & Fixed Versions\nAffected Version: 3.4.5\nFixed Version: Not yet released (vendor security patch under development)\n3. CVE ID\nCVE-2026-51272\n4. Prose Vulnerability Description\nA heap-based buffer overflow vulnerability exists in the latinToUTF8() character encoding conversion function inside src/Audio.cpp.\nThe function accepts untrusted Latin-1/Windows-1252 input strings extracted from audio metadata, stream labels and network request\nparameters. It calculates output buffer size using a simplistic strlen(input) * 2 + 1 formula without overflow or maximum length\nvalidation, then reallocates a fixed ps_ptr heap buffer. Malicious ultra-long Latin-1 input can cause \nthe size calculation logic to miscalculate required storage space; subsequent character-by-character UTF-8 encoding writes data\npast the actual allocated heap buffer boundary, triggering PSRAM heap memory corruption when processing untrusted audio files or\nremote streaming content.\n5. Vulnerability Type\nCWE-122: Heap-Based Buffer Overflow\n6. Root Cause\nTwo critical missing validation steps introduce the memory corruption flaw:\nNo hard maximum length limit enforced on raw Latin-1 source input strings before encoding size calculation.\nThe simple strlen(iso8859_1)*2+1 sizing formula does not account for maximum multi-byte UTF-8 expansion risk, and lacks integer \noverflow protection during calculation. The reallocated heap buffer is often undersized, while the encoding loop continues writing \nunlimited UTF-8 output bytes beyond buffer limits.\n7. Impact, Official PoC for CVE Request, PoC Rationale, Additional Information\nImpact\nPrimary Impact: Remote Denial of Service \u2014 ESP32 hardware watchdog forced hard reboot, permanent audio streaming service failure \nthat requires physical power cycle to recover.\nSecondary Impact: Predictable PSRAM heap memory layout enables remote arbitrary code execution within the audio library runtime \nprivilege level.\nAuxiliary Impact: Out-of-bounds heap read operations leak sensitive runtime, audio buffer and network metadata stored on the device.\nPoC (MITRE Standard Minimal Reproduction Code)\n\n// CVE-2026-51272 PoC: latinToUTF8 heap overflow reproduction\n// Test Environment: Arduino ESP32 Core, ESP-IDF v5.1, AddressSanitizer + PSRAM enabled build\n// Attack vector: Remote untrusted text metadata from audio streams/files\n#include \"Audio.h\"\n\n// Construct malicious oversized Latin-1 input string (16000 extended ASCII characters)\nString malicious_latin_input;\nfor(int i = 0; i < 16000; i++){\n    malicious_latin_input += (char)0xE6; // Extended Latin-1 character requiring 2-byte UTF-8 encoding\n}\n\nAudio audio;\n// Trigger vulnerable encoding function\nString utf8_result = audio.latinToUTF8(malicious_latin_input);\n\n// Expected PoC Behavior:\n// ASAN outputs clear heap-buffer-overflow write error logs\n// ESP32 watchdog timeout and automatic hardware reboot\n// No modified library source, custom firmware or special PSRAM configuration needed\nPoC Execution Steps\nFlash ESP32-S3/ESP32-P4 PSRAM hardware with stock ESP32-audioI2S v3.4.5 ASAN firmware.\nUpload the minimal test sketch containing long extended Latin-1 payload.\nExecute latinToUTF8() conversion call; flawed buffer sizing creates undersized heap storage.\nUTF-8 encoding writes exceed buffer limit, triggering ASAN heap violation and device crash.\nPoC Rationale\nThis minimal proof-of-concept reliably reproduces the heap overflow without custom hardware or \nmodified library builds. Extended Latin-1 characters double byte count after UTF-8 conversion; \nthe naive size calculation fails to bound total output capacity, creating an undersized ps_ptr \nheap buffer. The encoding loop writes unrestricted multi-byte data past allocation limits. The \nflaw reproduces consistently across all PSRAM-equipped ESP32 hardware variants when processing \nremote audio stream metadata or local media tag data.\nAttack is fully unauthenticated remote, no physical device access required.", "creation_timestamp": "2026-07-29T09:26:50.911123Z"}