A heap-based buffer overflow in schreibfaul1 ESP32-audioI2S 3.4.5 allows remote attackers to execute arbitrary code via malformed APIC frames in MP3 files.

This is a heap-based buffer overflow vulnerability in the ID3v2 APIC frame parsing function. The flaw is remotely exploitable without authentication, though it requires the processing of a crafted MP3 file.

With a CVSS score of 8.8, this vulnerability is considered high risk. Successful exploitation could lead to full system compromise or persistent denial of service. The ability to execute arbitrary code on embedded devices using this library presents a significant risk to operational continuity and data security.

Immediate Action: Update the ESP32-audioI2S library to version 3.4.6 or later to address the missing length validation.

Proactive Monitoring: Review application logs for errors related to audio parsing or unexpected service restarts that could indicate an exploitation attempt.

Compensating Controls: Utilize file inspection tools to verify the integrity and structure of MP3 files before passing them to the audio library for processing.

Public Exploit Available: No (no confirmed public exploit)

Immediate remediation is required to secure affected systems. Administrators should update to version 3.4.6 immediately to remove the vulnerable code path and protect against potential remote code execution attacks.