CVE-2026-38426

HighCVSS 7.3

Published: 27/05/2026(UTC)Updated: 23/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

45th percentile - higher than 45% of all known CVEs

Summary

Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv_10_scripter.ino, fetch_jpg(), jpg_task.boundary[40], strcpy() function.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary code remotely, potentially leading to control over the device or system.

Recommendation

It is recommended to update to the latest version of Tasmota to mitigate this vulnerability and to monitor systems for unauthorized activities.

Other vulnerabilities in arendst Tasmota

CVE-2026-38422High
A Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and earlier allows a remote attacker to execute arbitrary code via the fetch_jpg() function in tasmota/tasmota_xdrv_driver/xdrv_10_scripter.ino.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS