AudioBuffer::freeSpace() in the ESP32-audioI2S library incorrectly calculates available buffer space because it lacks mutex protection for shared read and write pointers. This race condition allows concurrent tasks to observe stale values, causing the function to report an overly large free space region. If the calling code trusts this value, the subsequent write operation can overrun the heap, corrupting memory. The resulting corruption can lead to a device crash or, in the worst case, arbitrary code execution due to controlled memory overwrites. The issue is a classic concurrency flaw, identified by CWE-362.

The vulnerability affects the schreibfaul1 ESP32-audioI2S library version 3.4.5 when used on ESP32-based boards. Any system that incorporates this library version and allows concurrent tasks to access the audio buffer is potentially impacted. No specific vendor or product name is listed beyond the library identifier, but users of the affected firmware are exposed to the risk.

The CVSS score of 9.8 indicates a critical severity. However, the EPSS score is below 1%, suggesting that the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog, so active exploits have not yet been reported. Exploitation would require an attacker or compromised application that can trigger simultaneous buffer operations, which is more likely in environments where multiple tasks or external inputs write to the audio stream. Given the lack of publicly documented exploits and the low EPSS, the immediate risk is moderate, but the high potential impact warrants swift remediation.