What is GHSA-25rr-x6m2-gphx?

GHSA-25rr-x6m2-gphx is a security advisory published by GitHub Security Advisories with High severity. Schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::decode()...

Which CVE IDs does GHSA-25rr-x6m2-gphx cover?

GHSA-25rr-x6m2-gphx covers the following CVE IDs: CVE-2026-51251. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-25rr-x6m2-gphx?

GHSA-25rr-x6m2-gphx has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-25rr-x6m2-gphxHighCVSS 7.5

Schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::decode()...

Vendor

GitHub Security Advisories

Published

July 28, 2026

Last Modified

July 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-51251 →

📋 Description

Schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::decode() function of the MP3 decoder due to missing size validation on untrusted mainDataBegin and nSlots values.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-51251
https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51251
https://github.com/schreibfaul1/ESP32-audioI2S/blob/master/src/mp3_decoder/mp3_decoder.cpp
https://github.com/advisories/GHSA-25rr-x6m2-gphx