CVE-2026-87961

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87961
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87961.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87961
Published
2026-09-10T10:52:37Z
Modified
2026-09-12T08:05:59Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header
Details

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a shadowed length parameter in ID3 synchronized-lyrics processing. Attackers can craft malicious MP3 files or HTTP audio streams with oversized frame size declarations to read past allocated buffer boundaries, causing device crashes or exposing adjacent heap memory.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87961.json"
}
References

Affected packages

Git / github.com/schreibfaul1/esp32-audioi2s

Affected ranges

Type
GIT
Repo
https://github.com/schreibfaul1/esp32-audioi2s
Events
Introduced
f01ad7923dcf3355eeca7fb99bf8a4d9945e7478
Fixed
490ff729eca344f06581f3e9bda9cfba948fd5a1
Fixed
4dc4614b9dab2de7b342d682b1c18b109d75b677
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.4.4"
        },
        {
            "fixed": "4.0.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.4.4
3.4.5
3.4.6
3.4.7
4.*
4.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87961.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "68934527224468691467650083414221013411",
                "111057713455196321598563883861499963005"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-87961-7ea15ab2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/schreibfaul1/esp32-audioi2s/commit/490ff729eca344f06581f3e9bda9cfba948fd5a1",
        "target": {
            "file": "src/Audio.cpp"
        }
    }
]
vanir_signatures_modified 
"2026-09-12T08:05:59Z"