Read the docs
TI-2026-83744 Aliases CVE-2026-120336GHSA-5m28-h7xq-m9g4

Stack-based overflow in VStarcam O-KAM Client DevDll_925.dll

Priority HIGH 70CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A stack-based buffer overflow in the function FUN_10003EA0 of the library DevDll_925.dll in VStarcam O-KAM Client 1.3.3.32 lets remote attackers write past a stack buffer (CWE-121). The exploit has been made public and could be used, and no authentication or user interaction is required. The vendor did not respond to early contact about this disclosure.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00324 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VStarcamO-KAM Client1.3.3.32—No fix listedCNA
  • O-KAM Client VendorVStarcam Affected 1.3.3.32 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:vstarcam:o-kam_client:*:*:*:*:*:*:*:*——VStarcam
  • cpe:2.3:a:vstarcam:o-kam_client:*:*:*:*:*:*:*:* Versions — — ·VStarcam

Remediation

The sources list no fixed version for VStarcam O-KAM Client.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120336
  2. 2026-11-02 Alias added: GHSA-5m28-h7xq-m9g4
  3. 2026-11-04 Priority changed: MEDIUM → LOW
  4. 2026-11-05 CISA SSVC decision points changed
  5. 2026-11-05 Priority changed: LOW → HIGH

References

Exploit 1

  • TI-2026-83745 VStarcam O-KAM SuperIPCam P2P Session Teardown Use After Free CVSS 4.0MEDIUM 6.9
  • TI-2019-08231 The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4… CVSS 3.0CRITICAL 9.8
  • TI-2019-09166 An issue was discovered in upgrade_htmls.cgi on VStarcam 100T (C7824WIP) KR75.8.53.20 and… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences