A critical buffer overflow vulnerability in the ESP32-audioI2S library version 3.4.5 poses a significant risk of remote code execution for unauthenticated attackers.

This vulnerability is a buffer overflow triggered by improper input validation within the MP3Decoder::UnpackSFMPEG1 function, which processes attacker controlled metadata. The attack is fully unauthenticated and requires no user interaction to trigger.

The CVSS score of 9.8 reflects the potential for complete compromise of the affected device. Successful exploitation allows an attacker to achieve remote code execution, leading to full system takeover, unauthorized data access, or the deployment of persistent malicious payloads on the underlying hardware.

Immediate Action: Since a specific patch version is not currently identified in the enrichment data, users should monitor the official GitHub repository for updates and restrict network access to devices utilizing this library.

Proactive Monitoring: Review device logs for unusual crashes or abnormal memory usage patterns that may indicate attempts to trigger the buffer overflow.

Compensating Controls: Implement network segmentation to isolate devices running the affected library from untrusted network traffic, effectively limiting the attack surface.

Public Exploit Available: Unknown

Given the critical CVSS severity and the presence of a proof-of-concept, users must prioritize the isolation of affected systems. Administrators should track the vendor repository for the release of a patched version and apply it immediately upon availability.