CVE-2026-38422: Tasmota Buffer Overflow RCE Vulnerability

CVE-2026-38422 Overview

CVE-2026-38422 is a stack-based buffer overflow [CWE-121] in the Tasmota firmware maintained by arendst. The vulnerability affects Tasmota version 15.3.0.3 and earlier releases. The flaw resides in the fetch_jpg() function within tasmota/tasmota_xdrv_driver/xdrv_10_scripter.ino. A remote attacker can exploit this weakness over the network to execute arbitrary code on affected devices. Tasmota is an open-source firmware widely deployed on ESP8266 and ESP32-based smart home and Internet of Things (IoT) devices, expanding the potential attack surface across consumer and commercial deployments.

Critical Impact

Remote attackers can execute arbitrary code on Tasmota-powered IoT devices without authentication or user interaction.

Affected Products

• arendst Tasmota firmware version 15.3.0.3
• All Tasmota firmware versions prior to 15.3.0.3
• ESP8266 and ESP32 devices running vulnerable Tasmota builds with the scripter driver enabled

Discovery Timeline

• 2026-05-27 - CVE-2026-38422 published to the National Vulnerability Database
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-38422

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow in the fetch_jpg() function of the Tasmota scripter driver. The scripter component (xdrv_10_scripter.ino) implements scripting capabilities that allow users to extend device behavior with custom logic. When the fetch_jpg() function processes JPEG data retrieved from a remote source, it fails to enforce sufficient bounds on the destination buffer. Attacker-controlled input can overrun the fixed-size stack buffer and overwrite adjacent memory, including return addresses and saved registers.

Exploitation results in arbitrary code execution on the embedded microcontroller. Because Tasmota firmware runs without traditional operating system isolation, successful exploitation grants full control of the device, including attached relays, sensors, and network interfaces. Compromised devices can serve as pivots into local networks or be conscripted into IoT botnets.

Root Cause

The root cause is missing input validation on data passed to a fixed-size stack buffer within fetch_jpg(). The function does not validate the length of remote JPEG content against the destination buffer size before copying. This classic [CWE-121] pattern allows linear overflow of the call stack.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who can reach the device's HTTP interface or induce it to fetch a crafted JPEG resource can trigger the overflow. Technical references and an exploit proof-of-concept are published in the GitHub CVE-2026-38422 Exploit repository, and the vulnerable source is visible in the Tasmota scripter driver source.

No verified code examples are reproduced here. See the linked references for technical details.

Detection Methods for CVE-2026-38422

Indicators of Compromise

• Unexpected outbound connections from Tasmota devices to unknown hosts or JPEG fetch endpoints
• Repeated device crashes, watchdog resets, or unexplained reboots following inbound HTTP requests
• Modifications to scripter rules or MQTT topics that were not made by authorized administrators
• HTTP requests targeting scripter endpoints with oversized URL parameters or unusual JPEG URL payloads

Detection Strategies

• Inventory all Tasmota devices and compare firmware versions against the patched release
• Inspect network traffic for HTTP requests to Tasmota web interfaces containing suspicious image fetch directives
• Correlate device reboot events with inbound network connections to identify exploitation attempts
• Enable verbose logging on Tasmota devices and forward logs to a centralized collector for anomaly review

Monitoring Recommendations

• Place Tasmota and other IoT devices on isolated VLANs and monitor cross-segment traffic
• Alert on any external network reachability to device management interfaces on port 80 or 443
• Track changes to device configuration, firmware checksums, and scripter rule sets over time

How to Mitigate CVE-2026-38422

Immediate Actions Required

• Upgrade Tasmota firmware to a version released after 15.3.0.3 that contains the fix
• Restrict network access to Tasmota device web interfaces using firewall rules or VLAN segmentation
• Disable the scripter driver on devices where scripting functionality is not required
• Audit existing devices for signs of compromise before applying updates

Patch Information

Monitor the Tasmota GitHub repository for the upstream fix to the fetch_jpg() function in xdrv_10_scripter.ino. Apply the patched firmware to all affected devices through Tasmota's over-the-air update mechanism or by reflashing from a trusted host.

Workarounds

• Disable the scripter feature in the Tasmota build configuration if it is not in use
• Block outbound HTTP fetches from Tasmota devices at the network perimeter
• Require authentication on the device web interface and use strong, unique credentials per device
• Place vulnerable devices behind a reverse proxy that filters oversized or malformed image fetch requests

# Example: Isolate Tasmota devices on a dedicated VLAN and restrict inbound access
iptables -A FORWARD -i vlan_iot -p tcp --dport 80 -m state --state NEW -j DROP
iptables -A FORWARD -o vlan_iot -p tcp --dport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT