CVE-2026-38426 describes a buffer overflow vulnerability in arendst Tasmota firmware version 15.3.0.3 and earlier. The issue is located in the xdrv_10_scripter.ino source file, specifically in the fetch_jpg() function where the jpg_task.boundary[40] buffer is manipulated using strcpy(), leading to potential memory corruption. This vulnerability could enable remote code execution if exploited. There is no CVSS score or vendor advisory available, and no patch or mitigation details have been provided.

Successful exploitation of this buffer overflow could allow a remote attacker to execute arbitrary code on the affected Tasmota device, potentially compromising device integrity and control. However, no known exploits have been reported in the wild, and the extent of impact depends on exploitation feasibility and device deployment context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations are available based on current information.