CVE-2026-55687: 
Espressif ESP-IDF Tools vulnerability analysis and mitigation

CVE-2026-55687 is a stack-based out-of-bounds write vulnerability in the JPEG decoder DQT marker parser of Espressif's ESP-IDF (IoT Development Framework). The flaw exists in jpeg_parse_dqt_marker() within components/esp_driver_jpeg/jpeg_parse_marker.c, where an attacker-controlled DQT marker Tq nibble is used as an array index without bounds validation, enabling malformed JPEG input to corrupt stack memory. Affected versions include ESP-IDF 6.0.0–6.0.1, 5.5.0–5.5.4, 5.4.0–5.4.4, and ≤5.3.5. The vulnerability was disclosed on June 22, 2026 via a GitHub Security Advisory and published to NVD on July 10, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). In jpeg_parse_dqt_marker(), the parser reads the PqTq byte from the JPEG stream and extracts the quantization-table destination identifier Tq from the low nibble (n &= 0x0F), then uses it directly as an index into qt_tbl[n] — a statically declared uint32_t[4][64] array on the stack. Since valid indices are 0–3 but Tq can be 0–15, a value of 4 or greater causes a write past the end of the array into adjacent stack memory. The attack vector is network-accessible (AV:N), requires no authentication or user interaction, and is exploitable by any code path that feeds attacker-controlled JPEG data into the hardware decoder, such as HTTP/MJPEG streams or data from removable media (GitHub Advisory).

The primary, reliably demonstrated impact is denial of service: a single malformed JPEG deterministically triggers a "Stack smashing protect failure" panic on ESP32-family devices equipped with the JPEG hardware decoder (notably ESP32-P4). Because the attacker controls both the content and offset of the out-of-bounds write, the crash can be re-triggered at will, resulting in a persistent, repeatable denial of service against affected IoT devices. On builds compiled without -fstack-protector-strong, where the affected stack frame lacks a canary, the attacker-controlled write may potentially be leveraged toward code execution, though exploitation beyond DoS has not been publicly demonstrated (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as "automatable" due to its network-accessible, no-authentication-required attack vector. The EPSS score is approximately 0.385%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly disclosed by researcher Hayden Steele (GitHub: HCS921) (GitHub Advisory).

1. Identify target: Locate an ESP32-P4 or other ESP32-family device running ESP-IDF versions ≤6.0.1, ≤5.5.4, ≤5.4.4, or ≤5.3.5 that exposes a JPEG decoding code path over the network (e.g., an HTTP server serving MJPEG streams or accepting image uploads).
2. Craft malformed JPEG: Construct a JPEG file containing a DQT (Define Quantization Table) segment where the PqTq byte has its low nibble (Tq) set to a value of 4 or greater (e.g., 0x04 through 0x0F). This is a trivial modification to any valid JPEG file using a hex editor.
3. Deliver malformed JPEG: Send the crafted JPEG to the target device via the exposed network interface — for example, as an HTTP POST body, an MJPEG stream frame, or any other mechanism that causes the device to invoke the hardware JPEG decoder on the input.
4. Trigger out-of-bounds write: The jpeg_parse_dqt_marker() function reads the Tq nibble and uses it as an index into the stack-allocated qt_tbl[4][64] array without bounds checking, writing attacker-controlled data past the end of the array into adjacent stack memory.
5. Achieve denial of service: On builds with stack protection enabled, the stack canary detects the corruption and triggers a "Stack smashing protect failure" panic, crashing and rebooting the device. The attack can be repeated indefinitely to maintain a persistent DoS condition (GitHub Advisory).

• Network: Repeated HTTP requests delivering JPEG payloads with malformed DQT segments (DQT marker 0xFFDB followed by a PqTq byte with low nibble ≥ 4) to an ESP32 device's image-processing endpoint.
• Device Logs/Console: Repeated "Stack smashing protect failure" panic messages or "Guru Meditation Error" crash dumps on the ESP32 serial console, particularly triggered by JPEG decoding operations.
• Device Behavior: Unexpected, repeated device reboots correlated with receipt of JPEG data from a network source or removable media; crash dumps referencing jpeg_parse_dqt_marker or jpeg_parse_marker.c in the stack trace.

Espressif has released ESP-IDF version 6.0.2 as the fixed release for the 6.0.x branch; fixes for 5.5.x (v5.5.5), 5.4.x (v5.4.5), and 5.3.x (v5.3.6) were pending release at the time of advisory publication. The fix adds a bounds check on the Tq nibble in jpeg_parse_dqt_marker() before any array write, rejecting out-of-range values with ESP_ERR_INVALID_ARG. As an interim workaround, Espressif recommends avoiding passing untrusted or unvalidated JPEG data to the hardware decoder. Upgrading to a patched release is the recommended long-term solution (GitHub Advisory, Fix Commit v6.0).

The vulnerability was credited to researcher Hayden Steele (HCS921) following responsible disclosure to Espressif. The advisory was published through GitHub's Security Advisory system and appeared in the CISA vulnerability bulletin (SB26-194). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.