---
id: CVE-2026-87961
title: >-
  ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds
  read vulnerability in the read_ID3_Header function due to a shadowed length
  parameter in ID3 synchronized-lyrics processing
summary: >-
  ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds
  read vulnerability in the read_ID3_Header function due to a shadowed length
  parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious
  MP3…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'
cwe:
  - CWE-125
vendor: schreibfaul1
product: ESP32-audioI2S
affected:
  - ESP32-audioI2S >= 3.4.4 <= 4.0.0
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T15:53:23.707'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87961'
references:
  - url: 'https://github.com/schreibfaul1/ESP32-audioI2S'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/schreibfaul1/ESP32-audioI2S/blob/490ff729eca344f06581f3e9bda9cfba948fd5a1/src/Audio.cpp#L2526-L2531
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/schreibfaul1/ESP32-audioI2S/blob/490ff729eca344f06581f3e9bda9cfba948fd5a1/src/Audio.cpp#L2629-L2635
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/schreibfaul1/ESP32-audioI2S/blob/f01ad7923dcf3355eeca7fb99bf8a4d9945e7478/src/Audio.cpp#L2270-L2276
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/schreibfaul1/ESP32-audioI2S/commit/4dc4614b9dab2de7b342d682b1c18b109d75b677
    label: disclosure@vulncheck.com
  - url: 'https://github.com/schreibfaul1/ESP32-audioI2S/issues/1380'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/schreibfaul1/ESP32-audioI2S/pull/1381'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/esp32-audioi2s-3.4.4-through-4.0.0-heap-based-out-of-bounds-read-via-shadowed-length-parameter-in-read-id3-header
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-10T14:22:26.738591Z'
ingestedAt: '2026-09-10T11:47:38.666Z'
epss: 0.0047
epssPercentile: 0.38033
---

## Overview

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size declarations to read past allocated buffer boundaries, causing device crashes or exposing adjacent heap memory.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.