CVE-2025-65092
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
ESF-IDF is the Espressif IoT Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder, the software parser lacks necessary validation checks. A specially crafted malicious JPEG image could exploit the parsing routine and trigger an out-of-bounds array access. This issue has been fixed in versions 5.5.2, 5.4.4, and 5.3.5.
Risk Assessment
An attacker could supply a malicious JPEG image to trigger an out-of-bounds array access, potentially leading to code execution or device crash. This may result in compromise of the IoT device.
Recommendation
Update ESF-IDF to version 5.5.2, 5.4.4, or 5.3.5, which contain the fix. Until updated, avoid processing untrusted JPEG images on ESP32-P4 devices.
Other vulnerabilities in ESF-IDF
Original NVD description (English source)
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder, the software parser lacks necessary validation checks. A specially crafted (malicious) JPEG image could exploit the parsing routine and trigger an out-of-bounds array access. This issue has been fixed in versions 5.5.2, 5.4.4, and 5.3.5. At time of publication versions 5.5.2, 5.4.4, and 5.3.5 have not been released but are fixed respectively in commits 4b8f585, c79cb4d, and 34e2726.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS