CVE-2026-87961

ESP32-audioI2S, an open-source audio-playback library for ESP32 microcontrollers, versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read (CWE-125) in the read_ID3_Header function, caused by a shadowed length parameter when processing ID3 synchronized-lyrics data. The flaw is triggered when the device parses a crafted MP3 file or HTTP audio stream whose ID3 frame declares an oversized frame size, causing the parser to read beyond the allocated buffer. An attacker who can make the device play such a stream (for example, a malicious internet-radio stream or MP3 file) can crash the device or expose small amounts of adjacent heap memory; there is no indication of remote code execution. Any ESP32-based device or embedded project built with the library in the affected version range that plays untrusted MP3 or HTTP audio content is exposed. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not in CISA's KEV catalog.

What to do: Projects built on ESP32-audioI2S should check which library version they compile against and update to the latest patched release beyond the affected 3.4.4–4.0.0 range, then rebuild and reflash affected firmware. Until patched, limit devices to streaming audio from trusted sources, since exploitation requires the device to parse an attacker-crafted MP3 file or HTTP stream. Monitor the project's repository and the VulnCheck advisory for the fixed version and any emerging proof-of-concept.