In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT synchronized lyrics parser in audiolib allows remote attackers to cause a d…

A heap-based buffer overflow vulnerability exists in schreibfaul1 ESP32-audioI2S version 3.4.5, specifically within the ID3v2 SYLT synchronized lyrics parser in audiolib. The flaw arises from missing bounds validation on attacker-controlled frame size values and improper memory access during lyric parsing. Remote attackers can exploit this vulnerability by supplying a crafted MP3 file, potentially leading to denial of service via application crash, information disclosure, or arbitrary code execution. The vulnerability is tracked as CVE-2026-51274 and affects embedded IoT audio streaming devices running the ESP32 platform. Given the potential for code execution on embedded hardware, the severity is considered high.