The flaw is a heap‑based buffer overflow found in the dismantle_host() function of ESP32‑audioI2S 3.4.5. Host and URL parsing logic copies untrusted strings into fixed‑size heap buffers via clone_from() without bounds checking, which can corrupt adjacent memory. This memory corruption can be leveraged to overwrite control‑flow data, resulting in arbitrary code execution or a denial of service. The weakness is classified as CWE‑122.

The vulnerability affects any installation that uses the 3.4.5 release of the ESP32‑audioI2S library. Devices or applications that expose the dismantle_host() routine to untrusted host or URL input are at risk. No vendor patch is currently available for this version.

The CVSS score of 9.8 signals a high impact, while the EPSS score of less than 1% indicates that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote; an attacker would need to supply crafted host or URL strings to a network service that uses the library, triggering the buffer overflow and enabling arbitrary code execution.