schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the connecttospeech() function. The application accepts attacker-controlled …

A heap-based buffer overflow vulnerability has been identified in schreibfaul1's ESP32-audioI2S library version 3.4.5. The vulnerability exists in the connecttospeech() function, which accepts attacker-controlled speech text input, performs URL encoding, and appends the result into a fixed-size heap buffer (ps_ptr) without proper input length validation or boundary checking. This allows remote attackers to craft oversized input that triggers an out-of-bounds heap write when constructing HTTP TTS request headers. Successful exploitation can lead to arbitrary code execution on the affected ESP32 device. The lack of input sanitization and buffer size enforcement is the root cause of this vulnerability. Given the IoT nature of ESP32 devices, this vulnerability could have significant implications for embedded systems using this audio library.