Read the docs
TI-2025-40245 Aliases CVE-2025-65092

ESP32-P4 JPEG Decoder Header Parsing Vulnerability

Priority LOW 31CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder, the software parser lacks necessary validation checks. A specially crafted (malicious) JPEG image could exploit the parsing routine and trigger an out-of-bounds array access. This issue has been fixed in versions 5.5.2, 5.4.4, and 5.3.5. At time of publication versions 5.5.2, 5.4.4, and 5.3.5 have not been released but are fixed respectively in commits 4b8f585, c79cb4d, and 34e2726.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
espressifesp-idf= 5.5.1; = 5.4.3; = 5.3.4—No fix listedCNA
  • esp-idf Vendorespressif Affected = 5.5.1; = 5.4.3; = 5.3.4 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:*——espressif
  • cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:* Versions — — ·espressif

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-65092

References

Other 5

  • TI-2026-31061 arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE CVSS 3.1CRITICAL 9.8
  • TI-2024-30765 Multiple Poisoned Pipeline Execution (PPE) vulnerabilities CVSS 3.1CRITICAL 10.0
  • TI-2026-30028 Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption CVSS 3.1HIGH 8.8
  • TI-2025-33484 CSRF Vulnerability in Firmware Update Endpoints Allows Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2024-22076 Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute… CVSS 3.1MEDIUM 6.5
  • TI-2025-33011 arduino-esp32 vulnerable to CRLF injection in WebServer.cpp CVSS 4.0HIGH 8.9
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences