A heap-based buffer overflow vulnerability has been identified in schreibfaul1 ESP32-audioI2S version 3.4.5, specifically within the ID3v2 SYLT (synchronized lyrics) parser in audiolib. The flaw arises from missing bounds validation on attacker-controlled frame size values and improper memory access during lyric parsing. Remote attackers can exploit this vulnerability by serving a crafted MP3 file to a vulnerable device. Successful exploitation may result in denial of service via application crash, information disclosure, or potentially arbitrary code execution. Given the IoT nature of ESP32-based devices, the attack surface includes any embedded system streaming audio from untrusted sources. The vulnerability has been assigned CVE-2026-51274 and is currently in a Received status on NVD. A proof-of-concept advisory has been published on GitHub by the researcher.