CVE-2026-55687 Overview
CVE-2026-55687 is an out-of-bounds write vulnerability in the Espressif IoT Development Framework (ESP-IDF) JPEG decoder. The flaw resides in jpeg_parse_dqt_marker() within components/esp_driver_jpeg/jpeg_parse_marker.c. The parser uses the attacker-controlled Define Quantization Table (DQT) marker Tq nibble as an index into the qt_tbl array without validating that it falls in the range 0..3. Supplying a malformed JPEG causes corruption of stack memory and triggers a reliable denial of service on affected ESP-IDF-based devices. Affected versions include 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly earlier releases. The issue is fixed in ESP-IDF 6.0.2, with fixes expected in 5.5.5, 5.4.5, and 5.3.6.
Critical Impact
Malformed JPEG input processed by ESP-IDF's hardware JPEG decoder corrupts stack memory, allowing unauthenticated attackers to reliably crash embedded IoT devices.
Affected Products
- ESP-IDF version 6.0.1
- ESP-IDF versions 5.5.4, 5.4.4, 5.3.5
- ESP-IDF versions prior to the above (potentially affected)
Discovery Timeline
- 2026-07-10 - CVE-2026-55687 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-55687
Vulnerability Analysis
The vulnerability is classified as a stack-based out-of-bounds write [CWE-121] in the ESP-IDF hardware JPEG decoder driver. When parsing a JPEG file's DQT marker, the decoder extracts the Tq (quantization table destination identifier) nibble from the marker header. This value should legally fall within the range 0..3, matching the four permitted quantization table slots defined by the JPEG specification. The affected code path uses Tq directly as an array index into qt_tbl without any bounds check. An attacker who supplies a crafted JPEG containing a DQT marker with Tq outside 0..3 causes the decoder to write 64 quantization coefficients past the intended stack buffer. The result is deterministic stack memory corruption and process termination.
Root Cause
The root cause is missing input validation on an attacker-controlled index. The JPEG parser trusts the Tq nibble decoded from external input and writes into qt_tbl[Tq] without ensuring Tq < JPEG_COMPONENT_NUMBER_MAX. The upstream fix introduces a qt_tbl_seen_mask field to track which quantization table entries have been legitimately populated by a DQT marker and adds strict range checks before indexed writes.
Attack Vector
Exploitation requires no authentication or user interaction. Any code path in a firmware application that decodes untrusted JPEG data using the ESP-IDF JPEG driver is exposed. Typical attack surfaces include network-facing image download handlers, camera streams, HTTP or MQTT image payloads, and firmware update artifacts. The attacker delivers a malformed JPEG containing a DQT marker whose Tq nibble exceeds 3, triggering stack corruption and denial of service.
uint8_t mcux; // the best value of minimum coding unit horizontal unit
uint8_t mcuy; // minimum coding unit vertical unit
uint8_t qt_tbl_num; // quantization table number
+ uint8_t qt_tbl_seen_mask; // bit i set => qt_tbl[i] populated by a DQT entry
uint32_t qt_tbl[JPEG_COMPONENT_NUMBER_MAX][JPEG_QUANTIZATION_TABLE_LEN]; // quantization table content [id]
uint8_t nf; // number of frames
uint8_t ci[JPEG_COMPONENT_NUMBER_MAX]; // Component identifier.
Source: Espressif Commit 303c013 — the patch introduces qt_tbl_seen_mask to track validly populated quantization table slots and enforces strict bounds checking on the Tq index.
Detection Methods for CVE-2026-55687
Indicators of Compromise
- Unexpected reboots or watchdog resets on ESP32-family devices immediately after receiving JPEG data over the network.
- Crash logs referencing jpeg_parse_dqt_marker or the esp_driver_jpeg component in device serial output.
- Inbound JPEG payloads whose DQT segment contains a Tq nibble greater than 3.
Detection Strategies
- Inspect network traffic to embedded devices for JPEG files and validate DQT marker Tq values at gateway or proxy layers.
- Enable ESP-IDF core dump capture and monitor for backtraces terminating inside the JPEG decoder.
- Perform fuzz testing of firmware image ingestion paths using malformed JPEG corpora to identify exposed decoders.
Monitoring Recommendations
- Aggregate device crash telemetry and alert on repeated JPEG-decoder-related resets across a fleet.
- Monitor upstream image sources and CDNs feeding IoT devices for unexpected file mutations or supply-chain tampering.
- Track ESP-IDF component versions across deployed firmware to identify devices still running vulnerable releases.
How to Mitigate CVE-2026-55687
Immediate Actions Required
- Update ESP-IDF to version 6.0.2 or later and rebuild affected firmware images.
- For maintenance branches, plan upgrades to 5.5.5, 5.4.5, and 5.3.6 once released and apply the referenced Espressif commits in the interim.
- Audit firmware for any code path that passes untrusted JPEG data to the esp_driver_jpeg component.
Patch Information
The fix is available in ESP-IDF Release v6.0.2 and is documented in Espressif Security Advisory GHSA-v6r2-f6p2-88cj. Backport commits for maintenance branches include Espressif Commit 6ffafe8, Commit 7ccfc00, Commit 82c5c2d, and Commit f2df45b.
Workarounds
- Reject or pre-validate incoming JPEG files at an upstream gateway before delivering them to ESP-IDF devices.
- Disable or bypass the esp_driver_jpeg decode path in firmware builds where JPEG processing is not required.
- Restrict network exposure of image-processing endpoints to trusted sources only.
# Verify the ESP-IDF version in a project and update to a fixed release
cd $IDF_PATH
git fetch --tags
git checkout v6.0.2
git submodule update --init --recursive
./install.sh
. ./export.sh
idf.py fullclean && idf.py build
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
