A global buffer overflow vulnerability exists in the GetSsmlAttribute function of espeak-ng versions 1.51 and 1.52.0. This issue was reported by OSS-Fuzz and involves an out-of-bounds read leading to a crash. The vulnerability has been fixed in a later commit.