# CVE-2026-120337: VStarcam O-KAM SuperIPCam P2P Session Teardown SuperIPCam.exe FUN_005a2d44 use after free

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- VStarcam / O-KAM SuperIPCam: 1.3.3.32 (affected). Source: CNA: VulDB

## Severity and prioritization

- CVSS 4.0: 6.9 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P; source: CNA: VulDB

- CVSS 3.1: 7.3 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R; source: CNA: VulDB

- CVSS 3.0: 7.3 (high); CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R; source: CNA: VulDB

- CVSS 2.0: 7.5 (high); AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR; source: CNA: VulDB

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-416, CWE-119

## Exploit evidence

- exploit: https://gist.github.com/Ishanoshada/cb73d61f792c77767338568501b135c9 (CNA: VulDB)

## References

- https://vuldb.com/vuln/429662 (CNA: VulDB; vdb-entry, technical-description)

- https://vuldb.com/vuln/429662/cti (CNA: VulDB; signature, permissions-required)

- https://vuldb.com/cve/CVE-2026-120337 (CNA: VulDB; third-party-advisory)

- https://vuldb.com/submit/1016302 (CNA: VulDB; third-party-advisory)

- https://gist.github.com/Ishanoshada/cb73d61f792c77767338568501b135c9 (CNA: VulDB; exploit)

## Provenance

- CNA: VulDB: https://www.cve.org/CVERecord?id=CVE-2026-120337; retrieved 2026-11-02; source updated 2026-11-02

Revision: dcb3b928a0b8c3ffa7e1880f181db5d71a65996318f649936d827692418bd43f

Canonical: https://y2.dev/cve/CVE-2026-120337