CVE-2025-65092mediumCWE-125CWE-191

CVE-2025-65092: fallo de gravedad media en espressif esp-idf

ESP32-P4 JPEG Decoder Header Parsing Vulnerability

Publicada el

Seguir esta CVE+ Monitorear esp-idf

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.4%
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder, the software parser lacks necessary validation checks. A specially crafted (malicious) JPEG image could exploit the parsing routine and trigger an out-of-bounds array access. This issue has been fixed in versions 5.5.2, 5.4.4, and 5.3.5. At time of publication versions 5.5.2, 5.4.4, and 5.3.5 have not been released but are fixed respectively in commits 4b8f585, c79cb4d, and 34e2726.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
espressif · esp-idf
CVEs relacionadas — espressif esp-idf

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-52471HIGHESP-NOW Integer Underflow Vulnerability AdvisoryEPSS 0.9%CVE-2026-55687HIGHESF-IDF: Stack-Based Out-of-Bounds Write in JPEG Decoder DQT Marker ParsingEPSS 0.7%CVE-2025-66409LOWESF-IDF has an Out-of-Bounds Read in ESP32 Bluetooth AVRCP Command HandlingEPSS 0.7%CVE-2024-53845MEDIUMAES/CBC Constant IV Vulnerability in ESPTouch v2EPSS 0.6%CVE-2022-24893HIGHEspressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruptionEPSS 0.5%CVE-2026-45541HIGHESF-IDF: Remote Null Pointer Dereference in WebSocket ServerEPSS 0.4%