CyberRota Analysis
AI-GeneratedThe Espressif Internet of Things Development Framework is vulnerable to an out-of-bounds write in the jpeg_parse_dqt_marker() function, which can be exploited through malformed JPEG input to corrupt stack memory, leading to a denial of service. Affected versions include 6.0.1, 5.5.4, 5.4.4, and 5.3.5, with fixes available in version 6.0.2 and upcoming patches for earlier versions. Organizations using these versions should prioritize updating to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write in jpeg_parse_dqt_marker() in components/esp_driver_jpeg/jpeg_parse_marker.c because the attacker-controlled DQT marker Tq nibble is used as an index into the qt_tbl array without validating that it is in the range 0..3, allowing malformed JPEG input to corrupt stack memory and reliably trigger a denial of service. This issue is fixed in version 6.0.2 and is expected to be fixed in versions 5.5.5, 5.4.5, and 5.3.6.