CVE-2025-65092

Published Nov 21, 2025

Last updated 3 months ago

CVSS medium 6.9
IoT

Overview

Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder, the software parser lacks necessary validation checks. A specially crafted (malicious) JPEG image could exploit the parsing routine and trigger an out-of-bounds array access. This issue has been fixed in versions 5.5.2, 5.4.4, and 5.3.5. At time of publication versions 5.5.2, 5.4.4, and 5.3.5 have not been released but are fixed respectively in commits 4b8f585, c79cb4d, and 34e2726.
Source
security-advisories@github.com
NVD status
Deferred

Risk scores

CVSS 4.0

Type
Secondary
Base score
6.9
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
MEDIUM

Weaknesses

security-advisories@github.com
CWE-125

Social media

Hype score
Not currently trending

  1. CVE-2025-65092 Out-of-Bounds Array Access in ESP32-P4 JPEG Decoder via Malicious Image https://t.co/yRPfcRMrg2

    @VulmonFeeds

    22 Nov 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. CVE-2026-25254
  2. Ubiquiti UniFi OS Improper Access Control Vulnerability•CVE-2026-34908
  3. Ubiquiti UniFi OS Path Traversal Vulnerability•CVE-2026-34909
  4. Ubiquiti UniFi OS Improper Input Validation Vulnerability•CVE-2026-34910
  5. Memory corruption while processing IOCTL command when device is in power-save state.•CVE-2026-25266

References

Sources include official advisories and independent security research.