schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the URL path concatenation and encoding module. The application splices untr…

A heap-based buffer overflow vulnerability has been identified in schreibfaul1 ESP32-audioI2S version 3.4.5. The flaw exists in the URL path concatenation and encoding module, where the application splices untrusted extension paths and attacker-controlled query strings into a path buffer without validating the final string length before invoking urlencode. Remote attackers can craft oversized malicious URL paths and query strings to trigger an out-of-bounds heap write. Successful exploitation can lead to arbitrary code execution, information disclosure, service crash, or privilege escalation. The vulnerability is remotely exploitable and affects embedded IoT audio streaming devices based on ESP32 hardware. Given the IoT context, affected devices may be difficult to patch and could remain exposed for extended periods.