A heap-based buffer overflow vulnerability (CVE-2026-51266) has been identified in schreibfaul1 ESP32-audioI2S version 3.4.5. The flaw exists in the HTTP request header construction logic, where attacker-controlled inputs such as host name, path, query string, and HTTP header fields are dynamically spliced into a fixed-size heap buffer (ps_ptr) without proper size validation or boundary checks. Remote attackers can exploit this vulnerability by crafting oversized network request parameters to trigger an out-of-bounds heap write. Successful exploitation can lead to arbitrary code execution on the affected device. The vulnerability affects IoT/embedded systems using the ESP32 platform running this audio library. No authentication appears to be required for exploitation, making this a significant remote attack surface. A proof-of-concept advisory has been published on GitHub alongside references to the vulnerable source file.