A buffer overflow vulnerability has been identified in schreibfaul1's ESP32-audioI2S library version 3.4.5. The flaw exists in the MP3Decoder::UnpackSFMPEG1 function and is caused by missing input validation on attacker-controlled MP3 metadata. An attacker could exploit this vulnerability by crafting malicious MP3 metadata to trigger a buffer overflow. This affects embedded/IoT systems using the ESP32-audioI2S library for audio decoding. The vulnerability is tracked as CVE-2026-51252 and has been assigned a high criticality rating. Proof-of-concept advisory details are available on GitHub. Users of the affected library version should apply patches or mitigations as soon as they become available.