A critical heap-based buffer overflow in the ESP32-audioI2S library may allow remote attackers to execute arbitrary code or crash the application through crafted input.

The latinToUTF8() function performs improper boundary validation during buffer reallocation. An attacker can provide oversized input to trigger an out-of-bounds write on the heap.

Exploitation of this heap overflow can lead to application crashes, system instability, or arbitrary code execution within the context of the audio processing task. With a CVSS score of 9.8, this vulnerability poses a significant risk to embedded devices utilizing this library, especially if they process untrusted audio streams.

Immediate Action: Review the library usage and monitor the official repository for a patched release; if no patch is available, consider implementing strict input validation on all data passed to the latinToUTF8() function.

Proactive Monitoring: Monitor device logs for unexpected reboots or memory-related errors that may indicate exploitation attempts.

Compensating Controls: Isolate devices running this library from public networks to limit the exposure to potentially malicious audio inputs.

Public Exploit Available: Unknown (No weaponized exploit confirmed).

This vulnerability represents a significant risk to the availability and security of devices running the affected library. Users should monitor the developer repository for a fix and apply updates as soon as they become available, while implementing input validation as a stopgap measure.