CVE-2026-55687High· 7.5▾ TwilightESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write in jpeg_parse_dqt_marker() in components/esp_driver_jpeg/jpeg_parse_marker.c …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
0.4% → 0.7%
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write in jpeg_parse_dqt_marker() in components/esp_driver_jpeg/jpeg_parse_marker.c because the attacker-controlled DQT marker Tq nibble is used as an index into the qt_tbl array without validating that it is in the range 0..3, allowing malformed JPEG input to corrupt stack memory and reliably trigger a denial of service. This issue is fixed in version 6.0.2 and is expected to be fixed in versions 5.5.5, 5.4.5, and 5.3.6.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-4273Medium· 6.0A flaw was found in the exFAT driver of the Linux kernel
CVE-2025-53593Medium· 6.5A buffer overflow vulnerability has been reported to affect several QNAP operating system versions
CVE-2025-53597Medium· 6.5A buffer overflow vulnerability has been reported to affect License Center
CVE-2022-2304High· 7.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.
CVE-2025-20719High· 8.8In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check
CVE-2025-20718High· 7.8In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check