CVE-2026-55687: ESP-IDF JPEG Parser Out-of-Bounds Write – Denial of Service

Technical summary

CVE-2026-55687 is an out-of-bounds write vulnerability in the jpeg_parse_dqt_marker() function within components/esp_driver_jpeg/jpeg_parse_marker.c of ESP-IDF. The DQT marker parsing code extracts a Tq nibble (4-bit field) from a malformed JPEG input and uses it directly as an index into the qt_tbl array without bounds checking. The qt_tbl array is sized to hold 4 entries (indices 0–3), but the attacker-controlled Tq value can be any value from 0–15, enabling out-of-bounds access. This results in a stack buffer overflow that corrupts adjacent stack memory, reliably causing a crash. The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). The CVSS 3.1 vector reflects network-adjacent attack surface, no privilege requirement, and high impact on availability.

Business impact

Organizations deploying ESP-IDF–based IoT devices in production environments face a critical availability risk. An attacker can remotely disable any affected device by sending a single malicious JPEG file, potentially disrupting entire deployments of smart home hubs, industrial controllers, edge cameras, or firmware-based services. Unlike vulnerabilities that require authentication or user interaction, this flaw enables a worm-like attack surface: any publicly accessible ESP-IDF service accepting JPEG input is exposed. Recovery requires manual intervention or remote device reset, multiplying operational costs in large-scale deployments. The widespread use of ESP-IDF across consumer and industrial IoT ecosystems amplifies the blast radius.

Affected systems

The vulnerability affects ESP-IDF versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and earlier releases. A fix is confirmed in version 6.0.2, with expected patches in versions 5.5.5, 5.4.5, and 5.3.6. Any ESP-IDF-based firmware built from affected versions remains vulnerable until rebuilt with a patched framework version. This includes third-party applications and device manufacturers who consume ESP-IDF as a component; their end-devices remain at risk until they release and deploy updated firmware. The actual scope of exposed devices depends on market adoption of affected versions and how many public-facing services accept JPEG input.

Exploitability

Exploitability is straightforward and requires minimal skill. An attacker must craft a JPEG file with a malicious DQT marker bearing an out-of-range Tq nibble value and transmit it to any ESP-IDF service accepting JPEG input. No authentication, special privileges, or user interaction is necessary. The network-accessible attack surface is wide; any service that parses JPEG without input validation is vulnerable. Proof-of-concept construction is trivial (modify a valid JPEG's DQT marker bytes), making this vulnerability likely to be weaponized quickly once public details emerge. The reliable denial-of-service outcome—guaranteed crash rather than intermittent misbehavior—makes it an attractive target for attackers seeking to disrupt services or infrastructure.

Remediation

Immediate remediation requires updating ESP-IDF to a patched version: 6.0.2 or later for mainline users, and 5.5.5, 5.4.5, or 5.3.6 when available for legacy branch users. Device manufacturers must rebuild their firmware against the patched framework and distribute over-the-air updates or firmware refresh images to deployed devices. Organizations unable to update immediately should implement network-level controls: restrict inbound JPEG traffic to trusted sources, disable JPEG parsing features if not required, or place affected devices behind authentication-requiring gateways. Validate that your IoT supply chain and third-party firmware images do not embed vulnerable ESP-IDF versions; this requires vendor communication and bill-of-materials review.

Patch guidance

Espressif has released ESP-IDF 6.0.2 with the fix applied. Users on version 6.0.1 should update immediately to 6.0.2. For older stable branches (5.5, 5.4, 5.3), monitor Espressif's official GitHub releases and security advisories for the availability of versions 5.5.5, 5.4.5, and 5.3.6 respectively. After patching the framework, dependent projects must be rebuilt and redeployed. Verify the patch by checking that the Tq nibble value is validated to be within the range 0–3 before indexing qt_tbl. Automated dependency scanning tools should be configured to flag any project still linked against vulnerable ESP-IDF versions.

Detection guidance

Monitor network traffic for malformed JPEG files sent to IoT devices or services running ESP-IDF. Detection is challenging without payload inspection, but anomalous JPEG headers (invalid DQT marker structures) or repeated crashes of ESP-IDF services after receipt of JPEG input may signal attack attempts. Enable device-level logging and crash dumps to capture stack corruption patterns. For defensive security operations, use intrusion detection signatures targeting suspicious DQT marker byte sequences or abnormal JPEG frame structures. Implement network segmentation to isolate JPEG-processing services and monitor for unexpected restarts or availability drops. Log all JPEG parsing errors and correlation with device crashes.

Why prioritize this

Despite a CVSS score of 7.5 (High), this vulnerability warrants immediate priority for several reasons: (1) Network-accessible attack surface with zero authentication barriers; (2) Trivial exploit construction and high likelihood of rapid weaponization; (3) Reliable denial-of-service impact affecting entire device fleets; (4) Widespread deployment of ESP-IDF across consumer and industrial IoT products; (5) Recovery requires manual intervention, amplifying downtime costs. Organizations should treat this as critical for any production IoT infrastructure, even though the CVSS vector does not reflect confidentiality or integrity impact.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-adjacent attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high impact on availability (A:H). The absence of confidentiality (C:N) or integrity (I:N) impacts prevents a critical rating. However, the practical risk is elevated by the ease of exploitation, deterministic crash outcome, and ubiquity of ESP-IDF in deployed systems. Organizations should not rely on the CVSS number alone; business context and asset criticality are paramount.

Frequently asked questions