PT-2026-57221 · Espressif · Esp-Idf

Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-55687

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write in jpeg parse dqt marker() in components/esp driver jpeg/jpeg parse marker.c because the attacker-controlled DQT marker Tq nibble is used as an index into the qt tbl array without validating that it is in the range 0..3, allowing malformed JPEG input to corrupt stack memory and reliably trigger a denial of service. This issue is fixed in version 6.0.2 and is expected to be fixed in versions 5.5.5, 5.4.5, and 5.3.6.

Correção

Memory Corruption

Stack Overflow

Enumeração de Fraquezas

CWE-787

CWE-121

Identificadores relacionados

CVE-2026-55687

Produtos afetados

Esp-Idf

Referências · 8

• https://github.com/espressif/esp-idf/releases/tag/v6.0.2 · Nota
• https://github.com/espressif/esp-idf/commit/6ffafe8e93142ef8ffe51a6311d4abfc0f10fe77 · Nota
• https://github.com/espressif/esp-idf/commit/7ccfc00f39faf1b7e5919f45b56fe44ba699d7c1 · Nota
• https://github.com/espressif/esp-idf/commit/82c5c2dad45313786fb7e973059bc9094d95c3b2 · Nota
• https://github.com/espressif/esp-idf/commit/f2df45bcedef11354e83c31a9718d680a68422c4 · Nota
• https://github.com/espressif/esp-idf/security/advisories/GHSA-v6r2-f6p2-88cj · Nota
• https://github.com/espressif/esp-idf/commit/303c01305acb8ae5c4eb24a1786300681b4822a4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-55687 · Nota de Segurança