A critical integer overflow in the ESP32-audioI2S library version 3.4.5 allows unauthenticated attackers to corrupt heap memory, leading to system crashes or potential code execution.

The software performs an unchecked unsigned integer overflow during buffer size calculation, which leads to insufficient PSRAM allocation. Subsequent read and write operations result in heap out of bounds access, which is exploitable by an unauthenticated remote attacker.

With a CVSS score of 9.8, this vulnerability represents a severe risk to device availability and integrity. Exploitation can cause persistent denial of service conditions or permit an attacker to gain full control over the affected device, potentially compromising the entire audio processing chain.

Immediate Action: Monitor the schreibfaul1 GitHub repository for security updates and firmware patches. Until a fix is released, restrict the input sources that feed audio data to the library to trusted origins only.

Proactive Monitoring: Monitor system performance and watchdog timers, as unexpected reboots or service instability may indicate exploitation attempts.

Compensating Controls: Utilize hardware or network level firewalls to inspect incoming traffic and block malformed packets that could trigger the overflow condition.

Public Exploit Available: Unknown

The high criticality of this vulnerability necessitates immediate defensive action. Users should ensure that any devices running the vulnerable ESP32-audioI2S library are isolated from the public internet while awaiting a vendor-supplied patch.