CVE-2026-51269
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-122
Desbordamiento de búfer basado en memoria dinámica (Heap)
Fecha de publicación:
28/07/2026
Última modificación:
28/07/2026
Descripción
*** Pendiente de traducción *** schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the connecttospeech() function. The application accepts attacker-controlled long speech text input, performs URL encoding, and directly appends the encoded result into a fixed ps_ptr heap buffer when constructing HTTP TTS request headers. Lack of input length validation and boundary checking allows remote attackers to craft oversized input to trigger out-of-bounds heap write, resulting in arbitrary code execution.
Impacto
Puntuación base 3.x
8.80
Gravedad 3.x
ALTA