A heap-based buffer overflow exists in the WAV header parsing function of ESP32‑audioI2S, where untrusted chunk size and bytes‑to‑skip fields are read without bounds checking. Abnormally large values lead to out‑of‑bounds heap read/write during header parsing, allowing an attacker to execute arbitrary code, disclose sensitive information, cause denial of service, or potentially elevate privileges.

The vulnerability affects the ESP32‑audioI2S library, version 3.4.5. This version is the only one documented as containing the unbounded parsing logic. No other products or versions are listed as affected.

The CVSS score of 9.6 indicates a critical impact, while the EPSS score of less than 1% reflects a low likelihood of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector involves supplying a malicious WAV file that the library processes, which can be delivered locally to the device or remotely if the device accepts audio streams from network sources. The lack of range checks in the parsing routine makes exploitation straightforward once the crafted file is read by the application.