CVE-2026-55687

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write in jpeg_parse_dqt_marker() in components/esp_driver_jpeg/jpeg_parse_marker.c because the attacker-controlled DQT marker Tq nibble is used as an index into the qt_tbl array without validating that it is in the range 0..3, allowing malformed JPEG input to corrupt stack memory and reliably trigger a denial of service. This issue is fixed in version 6.0.2 and is expected to be fixed in versions 5.5.5, 5.4.5, and 5.3.6.

• CWE-121
• CWE-787

• https://github.com/espressif/esp-idf/commit/303c01305acb8ae5c4eb24a1786300681b4822a4
• https://github.com/espressif/esp-idf/commit/6ffafe8e93142ef8ffe51a6311d4abfc0f10fe77
• https://github.com/espressif/esp-idf/commit/7ccfc00f39faf1b7e5919f45b56fe44ba699d7c1
• https://github.com/espressif/esp-idf/commit/82c5c2dad45313786fb7e973059bc9094d95c3b2
• https://github.com/espressif/esp-idf/commit/f2df45bcedef11354e83c31a9718d680a68422c4
• https://github.com/espressif/esp-idf/releases/tag/v6.0.2
• https://github.com/espressif/esp-idf/security/advisories/GHSA-v6r2-f6p2-88cj

Published

Jul 10, 2026

Last Modified

Jul 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55672ZITADEL is an open source identity management platform. Prio…7.4
• CVE-2026-55676Malcolm is a network traffic analysis tool suite. The file-u…8.8
• CVE-2026-55677Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo'…7.5
• CVE-2026-5568A vulnerability has been found in Akaunting up to 3.1.21. Th…3.5
• CVE-2026-55685React Router is a router for React. In versions 7.0.0 throug…7.5
• CVE-2026-55686Podman is a tool for managing OCI containers and pods. From …5.3
• CVE-2026-55688The AsyncHttpClient (AHC) library allows Java applications t…4
• CVE-2026-55689OpenFGA is an authorization/permission engine built for deve…8.1
• CVE-2026-5569A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.…9.8
• CVE-2026-55693Vim is an open source, command line text editor. Prior to 9.…7.8
• CVE-2026-55697pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm…8.8
• CVE-2026-55698pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm…8.8