The ESP32-audioI2S 3.4.5 library contains a heap‑based buffer overflow in the ID3v2 SYLT synchronized lyrics parser. The overflowing buffer is triggered by a maliciously crafted MP3 file that supplies an attacker‑controlled frame size exceeding the buffer limits, causing uncontrolled memory access. The vulnerability can lead to a denial of service, information disclosure, or the execution of arbitrary code on the host running the library.

The affected product is schreibfaul1's ESP32‑audioI2S library, version 3.4.5, used in ESP32 projects that parse MP3 files with ID3v2 tags.

The CVSS base score is 8.8, indicating high severity. The EPSS score is below 1 %, suggesting a low current exploitation probability, and it is not yet listed in CISA’s KEV catalog. Nevertheless, the vulnerability can be exploited remotely by presenting a crafted MP3 file to the application; the lack of bounds validation means the attacker only needs to supply a single offending file, making it straightforward to trigger the overflow. Attackers could crash the application, leak sensitive data from memory, or potentially execute code if the overflow reaches control‑flow data.