The ESP32-audioI2S library version 3.4.5 contains a heap‑based buffer overflow in the HTTP request header construction logic. Attackers can supply an oversized host name, path, query string or header fields that are concatenated into a fixed heap buffer without size checks, causing an out‑of‑bounds write. An attacker who can send a crafted HTTP request to the device can trigger this overflow and achieve arbitrary code execution on the ESP32. This flaw is catalogued as CWE‑122.

Any installation that uses the ESP32-audioI2S library 3.4.5 for handling HTTP requests is affected. The code is available in the schreibfaul1 GitHub repository and is commonly used by developers building custom audio streaming firmware for ESP32 devices.

The CVSS score of 9.8 indicates a critical severity, but the EPSS score of less than 1% suggests the likelihood of exploitation is currently low. The vulnerability can be exploited remotely by an attacker who can send network traffic to the ESP32, such as on open Wi‑Fi networks or exposed services. It is not yet listed in the CISA KEV catalog, so no widespread active exploits are reported, but the potential for remote code execution makes it a high‑risk flaw if the device is reachable from untrusted networks.