EUVD-2026-114837
GHSA-g8f3-phxq-9ggc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privilege access to Windows host
-
ExploitCraft oversized 'input' string argument
-
ExecutionCall P2PAPI_Connect in P2P SDK
-
ImpactOverflow buffer, crash component (local DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a Windows system running an application that loads P2PAPI.dll version 1.3.3.32, plus the ability (with at least low-level privileges, per PR:L) to invoke the P2P SDK's P2PAPI_Connect function and control the 'input' string argument passed to it. Limiting factors that reduce real-world risk: the attack is local only (no remote/network reach, AV:L), it is not fully unauthenticated (some privilege is needed), no user interaction of a victim is required, and the demonstrated impact is confined to availability (a crash, VA:L) with no confidentiality or integrity compromise. The specific version 1.3.3.32 is the confirmed affected build. |
| Impact | This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) describes a locally-exploitable flaw requiring the attacker to already have low-level privileges on the Windows host, with impact limited to availability only (VC:N/VI:N/VA:L) - no confidentiality or integrity loss and no scope change. The resulting base score of 1.9 is accurate for a local, privilege-requiring, availability-only buffer overflow. The vuln.today decision label is 'monitor', the lowest urgency tier, which aligns with the low CVSS. No EPSS score, no CISA KEV listing, and no SSVC automatability data were provided; absence of these is expected for a low-severity local bug and does not indicate hidden risk. A public PoC reference is present (a GitHub gist), and the description states the exploit was disclosed publicly, but the input does not confirm this as working, weaponized exploit code. The vendor (Hangzhou Xiongmai) was contacted and did not respond, so no patch is confirmed. Net: a real but minor defect - not a widespread-exploitation emergency - appropriately triaged as monitor. |
| Exploit ScenarioDerived | An attacker who already has local, low-privilege access to a Windows machine running software linked against P2PAPI.dll 1.3.3.32 invokes the P2PAPI_Connect function with an overly long or malformed 'input' string, overflowing a buffer in the P2P SDK and crashing the process (denial of service for that component). A public PoC reference exists but is not verified as working exploit code, and the impact is limited to availability loss on the local host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 01, 2026
Local buffer overflow in Hangzhou Xiongmai Technology's P2P SDK affects P2PAPI.dll 1.3.3.32 on Windows, where a crafted 'input' string passed to P2PAPI_Connect overflows a buffer. Per the independent assessment, exploitation requires local access and low-level privileges (AV:L/PR:L) and is confined to availability impact (VA:L, no confidentiality or integrity loss), scoring 1.9 - a genuinely low-priority, monitor-level issue. The vendor was contacted and did not respond, and the public disclosure includes a linked GitHub gist reference that has not been verified as working exploit code; no CISA KEV entry or other confirmed active exploitation signal is present.
RemediationAI
No vendor-released patch was identified at time of analysis: the vendor was contacted about the disclosure and did not respond, and no fixed version is published, so there is no upgrade path to cite. Compensating controls, with their trade-offs: bound and validate the length of the 'input' string before it reaches P2PAPI_Connect in any application that wraps the SDK (side effect: legitimate long inputs may be rejected, which can break P2P feature behaviour); restrict interactive logon and local execution rights on Windows hosts running applications that load P2PAPI.dll, since the attack requires local access with at least low privileges (side effect: tighter privilege management for workstation users); and where the P2P SDK is not operationally required, remove or avoid deploying it (side effect: loss of P2P connectivity features). Monitor for process crashes in applications loading P2PAPI.dll as a detection signal for attempted exploitation, and track the VulDB advisory at https://vuldb.com/vuln/429585 for any vendor response or fixed build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic buffer overflow (CWE-120) in the P2PAPI_Connect function of P2PAPI.dll, the Windows component of the Xiongmai P2P SDK; the CPE cpe:2.3:a:hangzhou_xiongmai_technology:p2papi.dll with wildcard versioning identifies the DLL itself as the affected artifact, while version 1.3.3.32 is the confirmed affected build. CWE-120 describes copying input into a destination buffer without validating its length, so a caller supplying an over-long 'input' string can overrun adjacent memory. The trigger is not described in more detail in the available sources. Per the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), the attacker must already be operating on the Windows host with at least low privileges and be able to invoke the SDK function and control its string argument; there is no network vector, no victim user interaction, and the demonstrated consequence is an availability impact (crash) rather than code execution. The CVSS 4.0 vector published by the reporter carries E:P, consistent with the description that exploit details were publicly disclosed.
Know when P2Papi Dll gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Local trigger via the P2PAPI_Connect input argument needs low privilege (AV:L, PR:L); buffer overflow yields only a crash, so C:N/I:N/A:L with unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows. Affected by this issue is the function P2PAPI_Connect of the component P2P SDK. Such manipulation of the argument input as part of String leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB