CVE-2026-38427 Details
Description
An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow. The Content-Length from a JPEG stream is stored in a uint16_t variable; values above 65535 wrap around, causing allocation of a smaller buffer than the data actually read.
A heap buffer overflow vulnerability has been identified in Tasmota versions through 15.3.0.3. The issue arises in the 'fetch_jpg()' function within the 'xdrv_10_scripter.ino' file. When Tasmota devices fetch MJPEG frames from an attacker-controlled server, the 'Content-Length' header is read into a 'uint16_t' variable. This can lead to an integer wraparound, where values exceeding 65535 are incorrectly truncated. As a result, a smaller buffer is allocated than needed, causing heap corruption. This vulnerability can lead to a crash or potentially allow remote code execution.
Tasmota has released a patch for this vulnerability in version 15.3.0.4 and later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sermikr0/CVE-2026-38427 | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/arendst/Tasmota/blob/c207cc2/tasmota/tasmota_xdrv_driver/xdrv_10_scripter.ino | [email protected] | Source CodeVendor |
| https://github.com/sermikr0/CVE-2026-38427 | [email protected] | ExploitTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Arendst Tasmota | <= 15.3.0.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |