A heap-based out‑of‑bounds read occurs in the read_ID3_Header function of ESP32-audioI2S when a shadowed length parameter is used during ID3 synchronized‑lyrics processing. The flaw allows an attacker’s crafted MP3 file or HTTP audio stream to declare an oversized frame size, causing the library to read past the end of a heap buffer. This can lead to a device crash or exposure of memory content adjacent to the buffer and is identified as CWE‑125.

The vulnerability affects ESP32-audioI2S versions 3.4.4 through 4.0.0, a library commonly used in ESP32 microcontrollers for handling audio streams.

The CVSS score of 7.1 indicates a high severity level. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. The attack vector is inferred to be an attacker who can supply a malicious MP3 file or audio stream, such as through a network service or local media loader. Exploitation would likely result in denial of service or memory disclosure but does not provide arbitrary code execution.