The vulnerability arises in the fetch_jpg() routine of Tasmota firmware up to 15.3.0.3. A 16‑bit unsigned variable stores the Content‑Length header of an incoming JPEG stream. When the declared length exceeds 65535 bytes, the value wraps around, resulting in allocation of a buffer smaller than the actual data. This heap buffer overflow allows a remote attacker who can supply a specially crafted JPEG stream to overwrite memory, potentially causing a device crash or other unintended behaviour, though arbitrary code execution is not documented.

Tasmota firmware 15.3.0.3 or earlier on any device running the affected build. No other vendors or products are listed.

The CVSS score of 7.3 reflects a high severity with a remote attack vector and user interaction not required. The EPSS score is not available; the vulnerability is not listed in KEV, suggesting no public exploits yet. An attacker only needs to send a JPEG stream with a Content‑Length header larger than 65535 bytes to trigger the overflow. Successful exploitation would most likely result in a device crash or service disruption.