ESP-IDF EUVD-2026-42939

Exploitation requires that attacker-controlled JPEG data reach the ESP-IDF hardware JPEG decode path (jpeg_parse_dqt_marker), i.e. the firmware must actually call the esp_driver_jpeg decoder on untrusted input, and the target must run an affected build (6.0.1, 5.5.4, 5.4.4, 5.3.5 or prior) on a chip with the JPEG codec. The concrete trigger is a JPEG DQT marker whose Tq nibble is outside 0..3. Per the CVSS vector no authentication or user interaction is required (PR:N/UI:N), but the real limiting factor is reachability: if the application only decodes trusted or locally-provisioned images, the AV:N rating overstates exposure and the vulnerability is effectively local - verify the JPEG ingest path per firmware. Impact is confined to denial of service (availability); no confidentiality or integrity effect is described.

The signals are consistent for a medium-to-high availability issue but do not indicate an emergency. CVSS 3.1 base is 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - impact is availability-only (C:N/I:N), matching the description's DoS outcome, so despite the stack-overflow primitive there is no confirmed confidentiality or integrity/code-execution impact. The AV:N (network) rating should be treated with caution: exploitation requires that a malformed JPEG actually reach the JPEG decode API, which is application-dependent (e.g. a network camera stream or an HTTP/MQTT image upload makes it remote, whereas a locally supplied image does not) - verify the real attack surface against how each firmware sources JPEG data. No EPSS score, KEV entry, or public POC was provided, so this is not confirmed to be exploited in the wild; it reads as a robustness/DoS bug rather than a widely-weaponized threat. Priority should scale with exposure: firmware that decodes attacker-reachable JPEGs should patch promptly, while devices that only decode trusted/local images are lower urgency.

An attacker who can deliver a JPEG to a device whose firmware decodes it - for instance uploading an image to a network-connected ESP32-P4 appliance or serving a malicious frame to a client that fetches remote images - crafts a JPEG whose DQT marker sets the Tq nibble to a value of 4 or higher. When the driver parses the marker it writes out of bounds on the stack, corrupting memory and crashing the device, forcing a reboot or hang. No public exploit code was identified, and the practical reach depends on whether the JPEG source is attacker-controlled and network-accessible.