schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openai_speech function in the Audio library manually constructs JSON request bodi…

CVE-2026-51263 affects schreibfaul1 ESP32-audioI2S version 3.4.5, an Arduino audio library for ESP32 microcontrollers. The vulnerability resides in the Audio::openai_speech function, which constructs JSON request bodies and HTTP headers by directly concatenating externally controllable input strings without proper length restrictions or boundary validation. This unsafe string concatenation allows an unauthenticated remote attacker to supply oversized malicious string data, triggering a heap buffer overflow during string splicing operations. The resulting memory corruption can lead to arbitrary code execution or denial of service conditions on affected embedded devices. The lack of input sanitization represents a classic buffer overflow pattern in embedded/IoT software. Given the IoT nature of the affected platform, exploitation could impact smart home devices, audio systems, or other ESP32-based products using this library.