Buffer Overflow Risk in Tasmota IoT Software by Arendst
CVE-2026-38426

7.3HIGH

Key Information:

Vendor

Arendst

Status
Tasmota
Vendor
CVE Published:
27 May 2026

What is CVE-2026-38426?

A buffer overflow vulnerability exists in Tasmota versions up to 15.3.0.3, enabling remote attackers to execute arbitrary code. This weakness arises from improper handling of input within the xdrv_10_scripter.ino module, specifically during operations using fetch_jpg() and strcpy() functions. Attackers can exploit this vulnerability to manipulate program execution, posing significant risks to the security of IoT devices running this software.

References

https://github.com/arendst/Tasmota/blob/c207cc2/tasmota/t...
https://github.com/sermikr0/CVE-2026-38426

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.