CVE-2026-51266
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
CWE-122
Desbordamiento de búfer basado en memoria dinámica (Heap)
Fecha de publicación:
28/07/2026
Última modificación:
28/07/2026
Descripción
*** Pendiente de traducción *** schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the HTTP request header construction logic. The application dynamically splices attacker-controlled host name, path, query string, and multiple HTTP header fields into a fixed ps_ptr heap buffer without proper size limitation and boundary validation. Remote attackers can use an oversized crafted network request parameter to trigger out-of-bounds heap write, leading to arbitrary code execution.
Impacto
Puntuación base 3.x
9.80
Gravedad 3.x
CRÍTICA