An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow. The Content-Length from a JP…

CVE-2026-38427 affects Tasmota firmware through version 15.3.0.3, specifically in the fetch_jpg() function within xdrv_10_scripter.ino. The vulnerability allows remote attackers to cause heap buffer overflow by exploiting improper handling of Content-Length values in JPEG streams. The issue occurs because Content-Length values are stored in a uint16_t variable, causing integer overflow when values exceed 65535, which results in allocation of insufficient buffer space compared to actual data being read.