CVE-2026-38427: Buffer Overflow

Q: Which systems are affected?

Tasmota through version 15.3.0.3 is affected when its scripting driver processes a JPEG stream through fetch_jpg().

Q: What does an attacker need to exploit this issue?

An attacker needs to provide or control a JPEG stream whose Content-Length exceeds 65,535. The oversized value wraps when stored in a uint16_t, resulting in a buffer allocation smaller than the data read.

Q: Is exploit code publicly available?

Yes. The available data flags a proof of concept and records an exploit publication date of 2026-05-25.

Published May 27, 2026

Updated

An issue in fetchjpg() in xdrv10scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow. The Content-Length from a JPEG stream is stored in a uint16t variable; values above 65535 wrap around, causing allocation of a smaller buffer than the data actually read.

Affected Software

1 affected component

Tasmota Tasmota<=15.3.0.3

Event History

May 25, 2026

Exploit Published

via GitHub·10:10 AM

May 27, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are affected?

Tasmota through version 15.3.0.3 is affected when its scripting driver processes a JPEG stream through fetch_jpg().

What does an attacker need to exploit this issue?

An attacker needs to provide or control a JPEG stream whose Content-Length exceeds 65,535. The oversized value wraps when stored in a uint16_t, resulting in a buffer allocation smaller than the data read.

Is exploit code publicly available?

Yes. The available data flags a proof of concept and records an exploit publication date of 2026-05-25.

CVE-2026-38427: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which systems are affected?

What does an attacker need to exploit this issue?

Is exploit code publicly available?

Company

Resources

Contact

Frequently Asked Questions

Which systems are affected?

What does an attacker need to exploit this issue?

Is exploit code publicly available?