


Perceptive Security
SOC/SIEM Consultancy

Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv_10_scripter.ino, fetch_jp…
Published:
26 May 2026 at 22:00:00
Alert date:
27 May 2026 at 20:13:42
Source:
nvd.nist.gov
Mobile & IoT
A buffer overflow vulnerability was discovered in arendst Tasmota v.15.3.0.3 and earlier versions. The vulnerability exists in the xdrv_10_scripter.ino component, specifically in the fetch_jpg() function where improper use of strcpy() with the jpg_task.boundary[40] buffer can lead to memory corruption. This flaw allows remote attackers to execute arbitrary code on affected Tasmota devices. The vulnerability impacts IoT devices running vulnerable Tasmota firmware versions. Given Tasmota's widespread use in smart home and IoT applications, this represents a significant security risk for connected device ecosystems.
Technical details
Mitigation steps:
Affected products:
Tasmota
Related links:
https://nvd.nist.gov/vuln/detail/CVE-2026-38426
https://github.com/arendst/Tasmota/blob/c207cc2/tasmota/tasmota_xdrv_driver/xdrv_10_scripter.ino
https://github.com/sermikr0/CVE-2026-38426
Related CVE's:
Related threat actors:
IOC's:
This article was created with the assistance of AI technology by Perceptive.
