CVE-2026-120337 Details
Description
A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A use-after-free vulnerability has been identified in VStarcam O-KAM SuperIPCam version 1.3.3.32. The issue arises in the P2P session teardown process, specifically within the function FUN_005a2d44 of the SuperIPCam.exe component. This vulnerability can be exploited remotely, leading to heap corruption and a subsequent crash of the application. The vulnerability has been publicly disclosed, and the vendor has not responded to initial contact regarding the issue.
To address this vulnerability, the critical section should be held during the teardown process to prevent concurrent access to freed memory. Alternatively, reference counting can be implemented so that the session object remains alive until all reading operations have completed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Ishanoshada/cb73d61f792c77767338568501b135c9 | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-120337 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1016302 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/429662 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/429662/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| VStarcam O-KAM SuperIPCam | 1.3.3.32 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |