CVE-2026-38427

Name of the Vulnerable Software and Affected Versions Tasmota versions prior to 15.3.0.4

Description A heap buffer overflow occurs in the fetch jpg() function within the xdrv 10 scripter.ino file. This happens because the Content-Length from a JPEG stream is stored in a uint16 t variable. When values exceed 65535, an integer wrap-around occurs, leading to the allocation of a buffer smaller than the actual data being read.

Recommendations Update Tasmota to version 15.3.0.4 or later. As a temporary mitigation, restrict the use of the fetch jpg() function.