PT-2025-47807 · Espressif · Esp32-P4+1

Published 2025-11-21 · Updated 2025-11-22 · CVE-2025-65092

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ESF-IDF versions 5.3.4 through 5.5.1

Description ESF-IDF, the Espressif Internet of Things (IOT) Development Framework, contains a flaw in its hardware JPEG decoder when used with the ESP32-P4. The software parser does not perform adequate validation checks on JPEG images. A crafted JPEG image can trigger an out-of-bounds array access within the parsing routine.

Recommendations Update to ESF-IDF version 5.3.5. Update to ESF-IDF version 5.4.4. Update to ESF-IDF version 5.5.2.

Exploit

Fix

Out of bounds Read

Integer Underflow

Weakness Enumeration

CWE-125

CWE-191

Related Identifiers

CVE-2025-65092

GHSA-VCW6-JC3P-4GJ8

Affected Products

Esf-Idf

Esp32-P4

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65092.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65092 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65092 · Vendor Advisory
• https://github.com/espressif/esp-idf/commit/34e2726254201988e6e2752b2db4b70d73964d4c · Note
• https://github.com/espressif/esp-idf/security/advisories/GHSA-vcw6-jc3p-4gj8 · Note
• https://github.com/espressif/esp-idf/commit/4b8f5859dbe05d15372558f8a950b49f6ee44e42 · Note
• https://github.com/espressif/esp-idf/commit/c38a6691b9845ac6ee0d0f6713783114770cdc17 · Note
• https://github.com/espressif/esp-idf/commit/c79cb4de468854937a0cbf82629fd65d04bffb27 · Note
• https://twitter.com/CVEnew/status/1991987616082735466 · Twitter Post
• https://t.me/CVEtracker/37981 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1992080321085309258 · Twitter Post