Back to security portal
Missing bounds check in JPEG image decoding
Reported on August 12, 2026
A specially crafted JPEG image could make the device’s image decoder attempt to write beyond its memory buffer. The write did not succeed and the device crashed instead, so no memory was corrupted. Fixed in firmware 2.13.0.
Reported by Averagebughunter
Reward 700 USD
Resolved vulnerabilities
Reported by community. Investigated. Resolved. Because your security is never optional.
- Authenticity proofs not bounded to their secure element on TS7August 16, 2026
- Stellar signer weight not shown when adding a signerAugust 8, 2026
- E-shop eGift card amount could be set outside the allowed valuesAugust 7, 2026
- Solana token transfer displays the address lookup table account instead of the token mintAugust 4, 2026
- Solana stake lockup settings not shown when stakingAugust 4, 2026
- Ethereum 1inch swap minimum output not shown on the deviceAugust 1, 2026