CVE-2026-120336 VStarcam CVE debrief

Who should care

Defenders responsible for VStarcam O-KAM Client systems should assess exposure and prioritize verification of the system's presence in their environment. They should also review compensating controls for exposed systems and monitor for potential exploitation attempts. Security teams and vulnerability management teams should also care about this vulnerability as it could lead to disruption of services or unauthorized access.

Why it matters

Defenders should care about CVE-2026-120336 because it is a remotely exploitable stack-based buffer overflow vulnerability in VStarcam O-KAM Client 1.3.3.32, which could lead to disruption of services, data breaches, or unauthorized access. The exploit has been made public, and the vendor has not responded.

• Remote exploitation of the vulnerability
• Potential disruption of VStarcam O-KAM Client services
• Need for verification of system presence and exposure
• Possible data breaches or unauthorized access

Technical summary

The vulnerability is caused by a stack-based buffer overflow in the FUN_10003EA0 function of the DevDll_925.dll library in VStarcam O-KAM Client 1.3.3.32. This can be exploited remotely. The vulnerability affects the VStarcam O-KAM Client and could lead to disruption of services or unauthorized access. The exploit has been made public, and defenders should prioritize verifying the presence of VStarcam O-KAM Client 1.3.3.32 in their environment and assessing exposure to remote exploitation. The vulnerability has not been patched by the vendor.

Defensive priority

Defenders should prioritize verifying the presence of VStarcam O-KAM Client 1.3.3.32 in their environment and assessing exposure to remote exploitation.

Recommended defensive actions

• Verify the presence of VStarcam O-KAM Client 1.3.3.32 in the environment
• Assess exposure to remote exploitation
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description and CVSS score. However, the vendor's response and affected versions are not specified. The vulnerability has been made public, and defenders should verify the presence of VStarcam O-KAM Client 1.3.3.32 in their environment. Evidence is limited to CVE and NVD entries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.