


Perceptive Security
SOC/SIEM Consultancy

Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv_10_scripter.ino, fetch_jp…
Published:
26 May 2026 at 22:00:00
Alert date:
27 May 2026 at 21:06:41
Source:
nvd.nist.gov
Mobile & IoT
A buffer overflow vulnerability has been discovered in arendst Tasmota firmware version 15.3.0.3 and earlier versions. The vulnerability exists in the xdrv_10_scripter.ino file within the fetch_jpg() function, specifically affecting the jpg_task.boundary[40] buffer through unsafe use of the strcpy() function. This security flaw allows remote attackers to execute arbitrary code on affected devices. The vulnerability represents a significant security risk for IoT devices running vulnerable versions of Tasmota firmware. Users should update to patched versions to mitigate the risk of remote code execution attacks.
Technical details
Mitigation steps:
Affected products:
Tasmota
Related links:
https://nvd.nist.gov/vuln/detail/CVE-2026-38426
https://github.com/arendst/Tasmota/blob/c207cc2/tasmota/tasmota_xdrv_driver/xdrv_10_scripter.ino
https://github.com/sermikr0/CVE-2026-38426
Related CVE's:
Related threat actors:
IOC's:
This article was created with the assistance of AI technology by Perceptive.
