A buffer overflow vulnerability has been identified in Schreibfaul1 ESP32-audioI2S version 3.4.5, specifically within the MP3Decoder::decode() function of the MP3 decoder component. The vulnerability arises from missing size validation on untrusted mainDataBegin and nSlots values sourced from external input. An attacker capable of supplying a malicious MP3 stream could potentially exploit this flaw to corrupt memory. The affected software is commonly used in IoT and embedded systems projects built on the ESP32 platform. No patch version is explicitly mentioned in the advisory. The vulnerability is tracked as CVE-2026-51251 and has been assigned a high criticality rating. Proof-of-concept advisory details are available on GitHub.