A heap‑based buffer overflow exists in the showID3Tag() function of the ESP32‑audioI2S library version 3.4.5. Untrusted ID3 tag values from malicious audio files are appended without length checking, allowing an attacker to overwrite heap memory, potentially enabling arbitrary code execution, memory leakage, device crash, or privilege escalation.

The vulnerability affects the ESP32‑audioI2S library, specifically release 3.4.5. Devices that use this library for audio streaming processing on ESP32 hardware are impacted. Any user who loads an audio file processed by this library risks exploitation.

The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1 % shows a very low yet non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires delivering a crafted audio file that triggers the overflow; the attack vector is a local or remote supply of the malicious file to the device. Successful exploitation can lead to arbitrary code execution or denial of service.