Technical impact
The issue is an out‑of‑bounds write in the JPEG decoder’s DQT marker parser. In jpeg_parse_dqt_marker() the Tq nibble from an attacker‑controlled JPEG image is used directly as an index into the qt_tbl array without checking that it is between 0 and 3. This lack of bounds validation can cause the decoder to write beyond the end of the stack buffer, corrupting stack memory and reliably triggering a denial of service. The weakness corresponds to CWE‑121 (Stack-based Buffer Overflow) and CWE‑787 (Out‑of‑Bounds Write).
Affected Systems
Espressif Internet of Things Development Framework (ESP‑IDF) versions 6.0.1, 5.5.4, 5.4.4, 5.3.5 and earlier are affected. The vulnerability is fixed in ESP‑IDF v6.0.2 and will be fixed in the forthcoming releases v5.5.5, v5.4.5, and v5.3.6.
Risk and Exploitability
The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is the delivery of a malicious JPEG file to any component that parses images, which can be remote or local depending on how the device receives image data. An attacker who can supply such a file may cause the target system to crash, resulting in a denial of service.
