CVE-2025-65092

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder, the software parser lacks necessary validation checks. A specially crafted (malicious) JPEG image could exploit the parsing routine and trigger an out-of-bounds array access. This issue has been fixed in versions 5.5.2, 5.4.4, and 5.3.5. At time of publication versions 5.5.2, 5.4.4, and 5.3.5 have not been released but are fixed respectively in commits 4b8f585, c79cb4d, and 34e2726.

• CWE-125
• CWE-191

• https://github.com/espressif/esp-idf/commit/34e2726254201988e6e2752b2db4b70d73964d4c
• https://github.com/espressif/esp-idf/commit/4b8f5859dbe05d15372558f8a950b49f6ee44e42
• https://github.com/espressif/esp-idf/commit/c38a6691b9845ac6ee0d0f6713783114770cdc17
• https://github.com/espressif/esp-idf/commit/c79cb4de468854937a0cbf82629fd65d04bffb27
• https://github.com/espressif/esp-idf/security/advisories/GHSA-vcw6-jc3p-4gj8

Published

Nov 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-65087An Out-of-Bounds Read vulnerability is present in Ashlar-Vel…7.8
• CVE-2025-65088An Out-of-Bounds Read vulnerability is present in Ashlar-Vel…7.8
• CVE-2025-65089XWiki Remote Macros provides XWiki rendering macros that are…6.5
• CVE-2025-6509A vulnerability was found in seaswalker spring-analysis up t…3.5
• CVE-2025-65090XWiki Full Calendar Macro displays objects from the wiki on …5.3
• CVE-2025-65091XWiki Full Calendar Macro displays objects from the wiki on …10
• CVE-2025-65093LibreNMS is an auto-discovering PHP/MySQL/SNMP based network…5.5
• CVE-2025-65094WBCE CMS is a content management system. Prior to version 1.…8.8
• CVE-2025-65095Lookyloo is a web interface that allows users to capture a w…9.4
• CVE-2025-65096RomM (ROM Manager) allows users to scan, enrich, browse and …4.3
• CVE-2025-65097RomM (ROM Manager) allows users to scan, enrich, browse and …6.5
• CVE-2025-65098Typebot is an open-source chatbot builder. In versions prior…7.4