{"id":"CVE-2026-120226","kind":"vulnerability","aliases":["CVE-2026-120226"],"related":[],"title":"Xiongmai P2PAPI.dll: buffer overflow in P2PAPI_Connect on Windows","description":"A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows. Affected by this issue is the function P2PAPI_Connect of the component P2P SDK. Such manipulation of the argument input as part of String leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A buffer overflow in the P2PAPI_Connect function of Xiongmai's P2PAPI.dll 1.3.3.32 P2P SDK on Windows can be triggered by a crafted input string. The sources say an attacker must be on the local machine, and a public exploit has been disclosed.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["iot-cameras","other","p2p-sdk","windows","xiongmai"],"not_affected_if":["no-local-access-by-attacker","no-p2papi-dll-installed"],"how_to_check":"- Look for `P2PAPI.dll` on Windows machines and check its version: 1.3.3.32 is the affected version named in the sources.\n- Check whether any installed application loads `P2PAPI.dll` from the Xiongmai P2P SDK.","fix":null,"status":"open","published_at":"2026-11-01T12:17:09+00:00","first_seen_at":"2026-11-01T12:19:56+00:00","triaged_at":"2026-11-01T12:21:20+00:00","updated_at":"2026-11-01T12:21:20+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-01T12:21:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Xiongmai P2PAPI.dll: buffer overflow in P2PAPI_Connect on Windows","impact":"medium","summary":"A buffer overflow in the P2PAPI_Connect function of Xiongmai's P2PAPI.dll 1.3.3.32 P2P SDK on Windows can be triggered by a crafted input string. The sources say an attacker must be on the local machine, and a public exploit has been disclosed.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","xiongmai","p2p-sdk","iot-cameras"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local attacker may overflow buffer, possibly running code","analyst_note":"Confirm the vendor fix status and whether the overflow allows code execution; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120226.","how_to_check":"- Look for `P2PAPI.dll` on Windows machines and check its version: 1.3.3.32 is the affected version named in the sources.\n- Check whether any installed application loads `P2PAPI.dll` from the Xiongmai P2P SDK.","plain_action":"","needs_analyst":true,"not_affected_if":["no-p2papi-dll-installed","no-local-access-by-attacker"],"who_is_affected":"Systems on Windows that have Xiongmai's P2PAPI.dll 1.3.3.32 installed, typically as part of a camera or device P2P software bundle. The sources say exploitation requires local access, so exposure is limited to machines where an attacker can already run code or input data. The vendor did not respond to early disclosure, so no fixed version is stated.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000745,"input_tokens":4194,"output_tokens":651,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-120226':12A,15A '-2026':11A,14A '1.3.3.32':37B,79C 'affect':82C 'approach':115C 'argument':100C 'attack':54B,111C 'buffer':3A,26B,108C 'camera':18B 'compon':93C 'connect':7A,31B,90C 'contact':130C 'craft':47B 'cve':10A,13A 'detect':73C 'disclos':67B,121C 'disclosur':134C 'earli':131C 'exploit':64B,118C 'function':32B,88C 'hangzhou':75C 'input':48B,101C 'iot':17B 'iot-camera':16B 'issu':85C 'lead':106C 'local':59B,116C 'machin':60B 'manipul':97C 'may':124C 'must':55B 'overflow':4A,27B,109C 'p2p':21B,38B,94C 'p2p-sdk':20B 'p2papi':6A,30B,89C 'p2papi.dll':2A,36B,78C 'part':103C 'public':63B,122C 'respond':138C 'say':52B 'sdk':22B,39B,95C 'secur':69C 'sourc':51B 'string':49B,105C 'technolog':77C 'trigger':44B 'use':126C 'vendor':128C 'vulner':70C 'way':141C 'window':9A,23B,41B,81C 'xiongmai':1A,24B,34B,76C","nicknames":[],"mitigations":[],"who_affected":"Systems on Windows that have Xiongmai's P2PAPI.dll 1.3.3.32 installed, typically as part of a camera or device P2P software bundle. The sources say exploitation requires local access, so exposure is limited to machines where an attacker can already run code or input data. The vendor did not respond to early disclosure, so no fixed version is stated.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T12:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120226","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120226","severity":null,"published_at":"2026-11-01T12:17:09+00:00","modified_at":"2026-11-01T12:17:09+00:00","first_seen_at":"2026-11-01T12:19:56+00:00","fetched_at":"2026-11-01T12:19:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}