# CVE-2026-55687: Espressif ESP-IDF out-of-bounds write in JPEG decoder

Source: https://junglewise.ai/threats/cve-2026-55687-espressif-esp-idf-out-of-bounds-write-in-jpeg-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55687 · Severity: high · CVSS 7.5 · Published 2026-07-10

Espressif ESP-IDF is a development framework used to build software for Internet of Things (IoT) devices like smart home appliances and industrial sensors. A vulnerability in its JPEG image processing component allows an attacker to crash a device by sending it a specially crafted image file over the network. This can lead to a permanent or repeated service outage, preventing the device from functioning correctly.

Technologies: [Espressif Systems ESP-IDF](https://junglewise.ai/threats/technologies/esp-idf). Vendors: [Espressif Systems](https://junglewise.ai/threats/vendors/espressif-systems).

## Quick answers

**Is CVE-2026-55687 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55687 being exploited in the wild.

**How severe is CVE-2026-55687?** High severity, with a CVSS score of 7.5, published 10 July 2026.

**Which products and versions are affected?** Espressif Systems ESP-IDF 6.0.1, 5.5.4, 5.4.4, 5.3.5.

**Is there a fix for CVE-2026-55687?** A patch was published on 2026-06-29: Version 6.0.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55687 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55687?** Check whether you run Espressif Systems ESP-IDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write exists in jpeg_parse_dqt_marker() within components/esp_driver_jpeg/jpeg_parse_marker.c. The vulnerability is caused by using an attacker-controlled 'Tq' nibble from the Define Quantization Table (DQT) segment as an index into the qt_tbl array without proper bounds checking. Since qt_tbl is a 4x64 array, a Tq value greater than 3 results in a write past the array boundaries into stack memory. This can be exploited by sending malformed JPEG data via network streams (e.g., HTTP or MJPEG) to trigger a deterministic crash (denial of service) or potentially achieve code execution on builds lacking stack protection. The issue is fixed in version 6.0.2 and planned for 5.5.5, 5.4.5, and 5.3.6.

## Affected products

- Espressif Systems ESP-IDF 6.0.1, 5.5.4, 5.4.4, 5.3.5

## Timeline

- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-06-29: patched: Version 6.0.2 released
- 2026-07-10: disclosed: CVE published to NVD

## References

- [https://github.com/espressif/esp-idf/commit/303c01305acb8ae5c4eb24a1786300681b4822a4](https://github.com/espressif/esp-idf/commit/303c01305acb8ae5c4eb24a1786300681b4822a4)
- [https://github.com/espressif/esp-idf/commit/6ffafe8e93142ef8ffe51a6311d4abfc0f10fe77](https://github.com/espressif/esp-idf/commit/6ffafe8e93142ef8ffe51a6311d4abfc0f10fe77)
- [https://github.com/espressif/esp-idf/commit/7ccfc00f39faf1b7e5919f45b56fe44ba699d7c1](https://github.com/espressif/esp-idf/commit/7ccfc00f39faf1b7e5919f45b56fe44ba699d7c1)
- [https://github.com/espressif/esp-idf/commit/82c5c2dad45313786fb7e973059bc9094d95c3b2](https://github.com/espressif/esp-idf/commit/82c5c2dad45313786fb7e973059bc9094d95c3b2)
- [https://github.com/espressif/esp-idf/commit/f2df45bcedef11354e83c31a9718d680a68422c4](https://github.com/espressif/esp-idf/commit/f2df45bcedef11354e83c31a9718d680a68422c4)
- [https://github.com/espressif/esp-idf/releases/tag/v6.0.2](https://github.com/espressif/esp-idf/releases/tag/v6.0.2)
- [https://github.com/espressif/esp-idf/security/advisories/GHSA-v6r2-f6p2-88cj](https://github.com/espressif/esp-idf/security/advisories/GHSA-v6r2-f6p2-88cj)

## Related threats

- [Espressif ESP-IDF out-of-bounds read in BlueDroid AVRCP parser](https://junglewise.ai/threats/cve-2026-46532-espressif-esp-idf-out-of-bounds-read-in-bluedroid-avrcp-parser)
- [Espressif ESP-IDF heap buffer overflow in protocomm Security2](https://junglewise.ai/threats/cve-2026-45542-espressif-esp-idf-heap-buffer-overflow-in-protocomm-security2)
- [Espressif ESP-IDF NULL pointer dereference in esp_http_server](https://junglewise.ai/threats/cve-2026-45541-espressif-esp-idf-null-pointer-dereference-in-esp-http-server)
- [Espressif ESP-IDF Out-of-Bounds Read in ESP-TEE Secure Service Wrappers](https://junglewise.ai/threats/cve-2026-45329-espressif-esp-idf-out-of-bounds-read-in-esp-tee-secure-service)
- [Espressif ESP-IDF out-of-bounds write in esp_tee component](https://junglewise.ai/threats/cve-2026-45328-espressif-esp-idf-out-of-bounds-write-in-esp-tee-component)