The vulnerability is a heap‑based buffer overflow in the htmlToUTF8() function of the ESP32‑audioI2S 3.4.5 library. It allows an attacker to supply oversized HTML entities that are incorrectly copied with memmove and memcpy, causing an out‑of‑bounds write. The resulting memory corruption can lead to remote code execution, arbitrary memory disclosure, service termination, or privilege escalation. This weakness is classified as CWE‑122.

The affected system is the ESP32‑audioI2S 3.4.5 library, used in ESP32 projects that process HTML content. The vendor is not specified in the advisory, but the code originates from the n/a author schreibfaul1. Any application that links against this library version and parses user‑supplied HTML entities is potentially vulnerable.

CVSS score 8.8 indicates high severity. EPSS score <1% shows a low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote: an adversary can deliver crafted HTML entities via any interface that feeds the library, such as a web front‑end, API payload, or configuration file. Exploitation would require memory corruption to inject or modify executable code; thus, high privileges on the host are not required, but extended execution is possible.