Executive Summary

CVE-2026-38427 is a critical vulnerability in the fetch_jpg() function of the xdrv_10_scripter component in Tasmota firmware versions 15.3.0.3 and earlier.

The issue arises because the Content-Length header from a JPEG stream is stored in a 16-bit unsigned integer (uint16_t). If the Content-Length value exceeds 65535, it wraps around due to integer overflow, causing the device to allocate a smaller buffer than needed.

This buffer undersizing leads to a heap buffer overflow when reading the JPEG data, which can corrupt memory and the device's HTTP/WiFi state.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial-of-service (DoS) conditions by crashing the device due to corrupted memory and network state.

Additionally, it may allow remote code execution (RCE), especially on ESP32 devices, enabling attackers to run arbitrary code without authentication.

The attack can be triggered remotely via a malicious MJPEG stream or a man-in-the-middle (MITM) attack, making it a serious risk for devices running vulnerable Tasmota versions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for abnormal MJPEG stream Content-Length headers exceeding 65535 bytes, which cause integer wraparound and heap buffer overflow in affected Tasmota devices.

Detection can involve capturing network traffic to identify MJPEG streams with unusually large Content-Length values or signs of corrupted HTTP/WiFi state on the device, such as unexpected crashes or denial-of-service symptoms.

• Use network packet capture tools like tcpdump or Wireshark to filter HTTP MJPEG streams and inspect Content-Length headers.
• Example tcpdump command to capture HTTP traffic on port 80: tcpdump -i <interface> tcp port 80 -w capture.pcap
• Analyze the capture with Wireshark, filter for HTTP MJPEG streams, and check for Content-Length values above 65535.
• Monitor device logs or behavior for crashes or resets that may indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Tasmota firmware to version 15.3.0.4 or later, where the vulnerability in fetch_jpg() has been patched.

Until the upgrade can be applied, consider restricting access to Tasmota devices from untrusted networks to prevent attackers from sending malicious MJPEG streams.

Additionally, avoid using or disable the script feature that processes MJPEG streams if possible, to reduce the attack surface.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0