# CVE-2026-38422: arendst Tasmota buffer overflow in fetch_jpg function

Source: https://junglewise.ai/threats/cve-2026-38422-arendst-tasmota-buffer-overflow-in-fetch-jpg-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-38422 · Severity: info · CVSS 9.8 · Published 2026-05-27

Tasmota is a popular open-source firmware used to control smart home devices like switches, lights, and sensors. A security flaw in how the firmware handles image downloads (MJPEG streams) allows a remote attacker to take complete control of the device. This could lead to the theft of Wi-Fi credentials, unauthorized access to the home network, or the device being used in a botnet.

Technologies: [Tasmota](https://junglewise.ai/threats/technologies/tasmota). Vendors: [Tasmota](https://junglewise.ai/threats/vendors/tasmota).

## Quick answers

**Is CVE-2026-38422 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38422 being exploited in the wild.

**How severe is CVE-2026-38422?** Informational severity, with a CVSS score of 9.8, published 27 May 2026.

**Which products and versions are affected?** Tasmota <= 15.3.0.3.

**Is there a fix for CVE-2026-38422?** A patch was published on 2026-05-01: Patch released in Tasmota v15.3.0.4+ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-38422 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-38422?** Check whether you run Tasmota at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists within the fetch_jpg() function in the scripter driver (xdrv_10_scripter.ino). It consists of two compounding memory corruption issues: a strcpy() overflow into a fixed 40-byte boundary buffer (Phase 1) and a uint16_t integer wraparound on the Content-Length header (Phase 2). By hosting a malicious MJPEG server or performing a Man-in-the-Middle (MitM) attack, an attacker can send a crafted HTTP response that corrupts heap memory, including WiFiClient and HTTPClient vtable pointers. This leads to arbitrary code execution or a persistent denial-of-service (crash loop) on ESP32-based devices. The vulnerability is addressed in Tasmota version 15.3.0.4 and later.

## Affected products

- arendst Tasmota <= 15.3.0.3

## Timeline

- 2026-03-29: disclosed: Vulnerabilities discovered and reported to MITRE
- 2026-05-27: advisory: CVE published by NVD/MITRE
- 2026-05-01: patched: Patch released in Tasmota v15.3.0.4+

## References

- [https://github.com/arendst/Tasmota](https://github.com/arendst/Tasmota)
- [https://github.com/arendst/Tasmota/blob/development/tasmota/tasmota_xdrv_driver/xdrv_10_scripter.ino](https://github.com/arendst/Tasmota/blob/development/tasmota/tasmota_xdrv_driver/xdrv_10_scripter.ino)
- [https://github.com/sermikr0/CVE-2026-38422](https://github.com/sermikr0/CVE-2026-38422)

## Related threats

- [Arendst Tasmota heap buffer overflow in fetch_jpg](https://junglewise.ai/threats/cve-2026-38427-arendst-tasmota-heap-buffer-overflow-in-fetch-jpg)
- [arendst Tasmota buffer overflow in fetch_jpg](https://junglewise.ai/threats/cve-2026-38426-arendst-tasmota-buffer-overflow-in-fetch-jpg)