A critical heap buffer overflow vulnerability exists in the AudioBuffer::writeSpace() function of schreibfaul1's ESP32-audioI2S library version 3.4.5. The vulnerability stems from an unsafe fixed-size memcpy operation that copies a full UINT16_MAX bytes without validating the available destination buffer space. This results in an out-of-bounds memory write condition that can be triggered remotely. The flaw is located in the Audio.cpp source file of the library. Because it affects an ESP32-based audio processing library widely used in IoT and embedded audio projects, the attack surface extends to any networked device utilizing this library. Successful exploitation could allow remote attackers to corrupt heap memory, potentially leading to arbitrary code execution or denial of service. The vulnerability has been assigned CVE-2026-51260 and is tracked in the NVD.