schreibfaul1 ESP32-audioI2S v3.4.5 has an integer underflow vulnerability in the MP3Decoder::GetBits() function of the MP3 decoder due to unchecked bit reading …

A critical integer underflow vulnerability (CVE-2026-51254) has been identified in schreibfaul1 ESP32-audioI2S v3.4.5, specifically within the MP3Decoder::GetBits() function of the MP3 decoder. The vulnerability stems from unchecked bit reading operations where the nBits parameter lacks proper validation. This causes the cachedBits counter to underflow to negative values, resulting in invalid bit manipulation and incorrect bitstream parsing. The impact ranges from application crashes to potential arbitrary code execution. Exploitation requires a specially crafted MP3 file to trigger the vulnerability. The affected library is widely used in ESP32-based IoT audio projects. No patch information is currently noted in the advisory.