{"id":"CVE-2026-120336","kind":"vulnerability","aliases":["CVE-2026-120336"],"related":[],"title":"VStarcam O-KAM Client: stack buffer overflow lets remote attackers run code","description":"A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A stack-based buffer overflow in the DevDll_925.dll library of the VStarcam O-KAM Client 1.3.3.32 can be triggered remotely. A public exploit exists, so an attacker could likely crash the client or run code on the machine running it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"O-KAM Client","fixed":[],"affected":"1.3.3.32","ecosystem":"vendor"}],"ecosystems":[],"tags":["cameras","desktop-client","o-kam","other","vstarcam","windows"],"not_affected_if":["unknown"],"how_to_check":"Check whether the O-KAM Client is installed on any Windows machine and whether it is version 1.3.3.32 (the only version named). The sources give no install path or way to read the version. Also check whether DevDll_925.dll sits in the client's install folder. Also check any other VStarcam desktop tools you run, since the sources do not rule them out.","fix":null,"status":"open","published_at":"2026-11-02T04:16:53+00:00","first_seen_at":"2026-11-02T04:51:28+00:00","triaged_at":"2026-11-02T04:52:21+00:00","updated_at":"2026-11-02T04:53:46+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-02T04:52:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"VStarcam O-KAM Client: stack buffer overflow lets remote attackers run code","impact":"high","summary":"A stack-based buffer overflow in the DevDll_925.dll library of the VStarcam O-KAM Client 1.3.3.32 can be triggered remotely. A public exploit exists, so an attacker could likely crash the client or run code on the machine running it.","audience":"businesses","category":"other","nicknames":[],"who_cares":["vstarcam","o-kam","windows","cameras"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote code runs on the machine running the client","analyst_note":"Confirm the affected network path, whether a patch or workaround exists, and whether the vendor has responded; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120336.","how_to_check":"- Check whether the VStarcam O-KAM Client is installed and what version it is: `unknown` (sources do not say how to read the version)\n- Look for `DevDll_925.dll` in the client install folder: unknown (sources do not give a path)","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The flaw is in the Windows desktop client O-KAM from VStarcam, version 1.3.3.32, in its DevDll_925.dll library. The sources do not say which network path reaches the vulnerable function or which configuration is needed. The vendor did not respond to early disclosure, so no patch is stated.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":4151,"output_tokens":586,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected network path, whether a patch or workaround exists, and whether the vendor has responded; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120336.","search":"'-120336':16A,19A '-2026':15A,18A '1.3.3.32':51B,85C '10003ea0':94C 'affect':86C 'attack':11A,62B,114C 'base':37B,105C 'buffer':7A,38B,106C 'camera':24B 'client':5A,23A,27B,50B,67B,84C 'code':13A,70B 'contact':129C 'could':63B,123C 'crash':65B 'cve':14A,17A 'desktop':26B 'desktop-cli':25B 'devdll_925.dll':42B,98C 'disclosur':133C 'earli':130C 'exist':59B 'exploit':58B,117C 'found':78C 'fun':93C 'function':92C 'kam':4A,22A,30B,49B,83C 'launch':112C 'let':9A 'librari':43B,97C 'like':64B 'machin':73B 'made':120C 'manipul':100C 'o':3A,21A,29B,48B,82C 'o-kam':2A,20A,28B,47B,81C 'overflow':8A,39B,107C 'possibl':110C 'public':57B,121C 'remot':10A,55B,115C 'respond':137C 'result':101C 'run':12A,69B,74B 'stack':6A,36B,104C 'stack-bas':35B,103C 'trigger':54B 'use':125C 'vendor':127C 'vstarcam':1A,32B,46B,80C 'vulner':76C,89C 'way':140C 'window':33B","nicknames":[],"mitigations":[],"who_affected":"Windows users running the VStarcam O-KAM Client desktop app, version 1.3.3.32 (DevDll_925.dll, function FUN_10003EA0). VulDB says the attack is remote and needs no authentication, but neither VulDB nor NVD says which network path or input reaches the function (for example camera or P2P traffic). Teams that do not run this Windows client can skip it. The mobile app O-KAM Pro and the camera firmware are not named in any source.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["client","okamclient"],"ptokens":["client","kam"],"labels":["cameras","desktopclient","high","okam","other","vstarcam","windows"],"first_public_at":"2026-11-02T04:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120336","severity":null,"published_at":"2026-11-02T04:16:53+00:00","modified_at":"2026-11-02T04:16:53+00:00","first_seen_at":"2026-11-02T04:51:28+00:00","fetched_at":"2026-11-02T04:51:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120336:1345","url":null,"severity":null,"published_at":"2026-11-02T04:53:46+00:00","modified_at":"2026-11-02T04:53:46+00:00","first_seen_at":"2026-11-02T04:53:46+00:00","fetched_at":"2026-11-02T04:53:46+00:00","note":"VulDB (CNA) and NVD: stack overflow in FUN_10003EA0 of DevDll_925.dll, O-KAM Client 1.3.3.32, remote, no auth, PoC published on a GitHub gist (link not shown on the VulDB page, so not read). Vendor did not respond; no fix or mitigation known, VulDB suggests replacing the product. No vendor page, so nothing verified. Related: CVE-2026-120337 (SuperIPCam.exe, same version). Not seen exploited."}],"documents":[{"id":42321,"url":"https://vuldb.com/vuln/429661","title":"VulDB VDB-429661: VStarcam O-KAM Client DevDll_925.dll stack-based overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":42322,"url":"https://app.opencve.io/cve/CVE-2026-120336","title":"OpenCVE CVE-2026-120336","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}