CVE-2026-55687
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.
Impact
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write in jpeg_parse_dqt_marker() in components/esp_driver_jpeg/jpeg_parse_marker.c because the attacker-controlled DQT marker Tq nibble is used as an index into the qt_tbl array without validating that it is in the range 0..3, allowing malformed JPEG input to corrupt stack memory and reliably trigger a denial of service. This issue is fixed in version 6.0.2 and is expected to be fixed in versions 5.5.5, 5.4.5, and 5.3.6.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/espressif/esp-idf/commit/303c01305acb8ae5c4eb24a1786300681b4822a4
- https://github.com/espressif/esp-idf/commit/6ffafe8e93142ef8ffe51a6311d4abfc0f10fe77
- https://github.com/espressif/esp-idf/commit/7ccfc00f39faf1b7e5919f45b56fe44ba699d7c1
- https://github.com/espressif/esp-idf/commit/82c5c2dad45313786fb7e973059bc9094d95c3b2
- https://github.com/espressif/esp-idf/commit/f2df45bcedef11354e83c31a9718d680a68422c4
- https://github.com/espressif/esp-idf/releases/tag/v6.0.2
- https://github.com/espressif/esp-idf/security/advisories/GHSA-v6r2-f6p2-88cj