In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag() of the embedded audio strea…

A heap-based buffer overflow vulnerability (CVE-2026-51273) has been identified in schreibfaul1's ESP32-audioI2S library version 3.4.5. The flaw resides in the ID3 tag parsing function showID3Tag(), where untrusted long ID3 tag values from malicious audio files are processed using an unbounded appendf() call. This writes formatted strings into a ps_ptr heap buffer without any length validation, creating a classic heap overflow condition. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target ESP32 device, leak sensitive memory data, cause a device crash (denial of service), or escalate privileges. The attack vector requires delivering a specially crafted malicious audio file to the target device. This vulnerability is particularly significant given ESP32's widespread use in IoT and embedded audio streaming applications, potentially affecting a large number of deployed devices.