Executive brief
Espressif ESP-IDF is a development framework used to build software for Internet of Things (IoT) devices like smart home appliances and industrial sensors. A vulnerability in its JPEG image processing component allows an attacker to crash a device by sending it a specially crafted image file over the network. This can lead to a permanent or repeated service outage, preventing the device from functioning correctly.
Technical details
An out-of-bounds write exists in jpeg_parse_dqt_marker() within components/esp_driver_jpeg/jpeg_parse_marker.c. The vulnerability is caused by using an attacker-controlled 'Tq' nibble from the Define Quantization Table (DQT) segment as an index into the qt_tbl array without proper bounds checking. Since qt_tbl is a 4x64 array, a Tq value greater than 3 results in a write past the array boundaries into stack memory. This can be exploited by sending malformed JPEG data via network streams (e.g., HTTP or MJPEG) to trigger a deterministic crash (denial of service) or potentially achieve code execution on builds lacking stack protection. The issue is fixed in version 6.0.2 and planned for 5.5.5, 5.4.5, and 5.3.6.
Affected products
- Espressif Systems ESP-IDF 6.0.1, 5.5.4, 5.4.4, 5.3.5
Timeline
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-06-29: patched: Version 6.0.2 released
- 2026-07-10: disclosed: CVE published to NVD
References
- https://github.com/espressif/esp-idf/commit/303c01305acb8ae5c4eb24a1786300681b4822a4
- https://github.com/espressif/esp-idf/commit/6ffafe8e93142ef8ffe51a6311d4abfc0f10fe77
- https://github.com/espressif/esp-idf/commit/7ccfc00f39faf1b7e5919f45b56fe44ba699d7c1
- https://github.com/espressif/esp-idf/commit/82c5c2dad45313786fb7e973059bc9094d95c3b2
- https://github.com/espressif/esp-idf/commit/f2df45bcedef11354e83c31a9718d680a68422c4
- https://github.com/espressif/esp-idf/releases/tag/v6.0.2
- https://github.com/espressif/esp-idf/security/advisories/GHSA-v6r2-f6p2-88cj