CVE-2026-120226 Details
Description
A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows. Affected by this issue is the function P2PAPI_Connect of the component P2P SDK. Such manipulation of the argument input as part of String leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A buffer overflow vulnerability has been identified in Hangzhou Xiongmai Technology's P2PAPI.dll version 1.3.3.32, used by the O-KAM SuperIPCam application on Windows. The issue arises in the P2PAPI_Connect function, part of the P2P SDK, where the lack of input length validation allows for oversized string arguments to be copied into fixed-size heap buffers. This manipulation leads to an out-of-bounds write, causing a heap buffer overflow and a local denial-of-service condition by crashing the application. The vulnerability is triggered by using the 'VSTD' prefix, which directs the call to a channel constructor that exacerbates the overflow by packing the buffers tightly, allowing the overflow to cross into unmapped memory and cause an access violation.
Users are advised to manually bound all string inputs before calling the P2PAPI_Connect function, ensuring that no field exceeds 63 bytes. Additionally, the P2PAPI.dll should be recompiled with stack protection enabled and Control Flow Guard activated.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/1013929 | CISA-ADP | Issue TrackingPermission Required |
| https://gist.github.com/Ishanoshada/a47d24d77dd03f34c7f324491b59edac | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-120226 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1013929 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/429585 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/429585/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hangzhou Xiongmai Technology P2PAPI.dll | 1.3.3.32 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | [email protected] |