CVE-2026-38427
HighSummary
Tasmota versions up to 15.3.0.3 contain an issue in the fetch_jpg() function that allows a remote attacker to cause a heap buffer overflow. The Content-Length from a JPEG stream is stored in a uint16_t variable, leading to allocation of a smaller buffer than the data actually read when the value exceeds 65535.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code or destabilize the system, potentially leading to serious security implications for the organization.
Recommendation
It is recommended to update Tasmota to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Original NVD description (English source)
An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow. The Content-Length from a JPEG stream is stored in a uint16_t variable; values above 65535 wrap around, causing allocation of a smaller buffer than the data actually read.