EUVD-2026-42939Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Availability-only DoS (A:H, C:N/I:N) with no auth or interaction; AV:N retained since JPEG input is often network-sourced, though reachability is application-dependent.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write in jpeg_parse_dqt_marker() in components/esp_driver_jpeg/jpeg_parse_marker.c because the attacker-controlled DQT marker Tq nibble is used as an index into the qt_tbl array without validating that it is in the range 0..3, allowing malformed JPEG input to corrupt stack memory and reliably trigger a denial of service. This issue is fixed in version 6.0.2 and is expected to be fixed in versions 5.5.5, 5.4.5, and 5.3.6.
AnalysisAI
Denial of service in Espressif's ESP-IDF JPEG driver (versions 6.0.1, 5.5.4, 5.4.4, 5.3.5 and likely earlier) stems from an out-of-bounds stack write in jpeg_parse_dqt_marker(), where the attacker-controlled DQT marker Tq nibble indexes the qt_tbl array without a 0..3 bounds check. Any application that feeds untrusted JPEG data into the hardware JPEG decode path can be reliably crashed by a single malformed image. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor has released a fix in 6.0.2 with backports pending for the 5.x branches.
Technical ContextAI
ESP-IDF is Espressif's official SDK for the ESP32 family of microcontrollers, and the affected code lives in components/esp_driver_jpeg/jpeg_parse_marker.c, the driver that parses JPEG headers before handing data to the hardware JPEG codec (present on parts such as the ESP32-P4). A JPEG Define Quantization Table (DQT) marker encodes, per table, a byte whose low nibble (Tq) selects the destination quantization table slot; the JPEG standard permits only values 0 through 3. The driver uses this attacker-supplied Tq value directly as an index into the fixed-size qt_tbl array without range validation, so a crafted value of 4-15 writes past the end of the array. This is a classic CWE-121 stack-based buffer overflow: because qt_tbl resides on the stack, the write corrupts adjacent stack memory, and the reported consequence is a reliable crash rather than demonstrated code execution.
RemediationAI
Vendor-released patch: ESP-IDF 6.0.2 - upgrade to it on the 6.0.x branch and rebuild/reflash affected firmware. For devices pinned to the long-term-support branches, the fix is expected in 5.5.5, 5.4.5, and 5.3.6 (not yet released at time of analysis); until those tags ship, cherry-pick the upstream commits referenced in the advisory (e.g. 303c01305acb8ae5c4eb24a1786300681b4822a4 and the companion commits f2df45bc, 6ffafe8e, 7ccfc00f, 82c5c2da) which add the missing Tq range validation. As a compensating control where reflashing is not immediately feasible, restrict or filter untrusted JPEG input before it reaches the decoder - for example validate/reject images from network-facing endpoints, or gate the JPEG decode path behind an application-layer bounds check on DQT markers; the trade-off is that input filtering adds latency and only helps where the firmware controls the ingest path. Advisory: https://github.com/espressif/esp-idf/security/advisories/GHSA-v6r2-f6p2-88cj.
Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. Rated high severity (
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows th
An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script t
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes
A security vulnerability in the ESP-NOW protocol implementation within the ESP Wi-Fi component of (CVSS 9.8). Critical s
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earli
Privilege escalation from REE to TEE in Espressif ESP-IDF 5.5.4 and 6.0 lets a low-privileged user-application caller ab
ESP-IDF is the official development framework for Espressif SoCs. Rated high severity (CVSS 8.8), this vulnerability is
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page up
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the external
Remote denial-of-service in Espressif ESP-IDF's esp_http_server WebSocket handshake allows unauthenticated attackers to
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today