VStarcam O-KAM Client EUVD-2026-115060

Exploitation requires reaching the function FUN_10003EA0 within DevDll_925.dll in O-KAM Client version 1.3.3.32 with attacker-controlled data that overflows a stack buffer; the exact feature, protocol, or code path that passes untrusted input to this function is not described in the available sources. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), but as this is client-side software, realistic remote exploitation likely depends on getting the client to process malicious data (e.g., from a rogue or compromised peer/server) - this limiting factor is not confirmed in the sources. Exploitation is further limited to the specific affected version, and the Low C/I/A impact ratings suggest constrained consequences rather than full system takeover.

The VulDB-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 (medium) and portrays easy remote, unauthenticated triggering with no attack requirements. However, the impact sub-metrics are only Low across the board (VC:L/VI:L/VA:L, SC/SI/SA:N), which is notably conservative for a stack-based buffer overflow (CWE-121) that could in principle yield code execution - this tension is worth verifying, as the Low impacts imply limited attacker control rather than full compromise. The 'network' vector should be read in context: O-KAM is client software (DevDll_925.dll), so realistic remote exploitation generally depends on inducing the client to process attacker-controlled data, and the sources do not describe the trigger path. On real-world signals: this is not in CISA KEV (no confirmed active exploitation), no EPSS score was provided to gauge exploitation probability, and the PoC is an unverified reference rather than confirmed working exploit code. The embedded E:P (Proof-of-Concept) maturity and the VulDB 'this_month' priority both point to a moderate, scheduled-remediation issue rather than an emergency. Net: a credible but mid-severity client-side flaw, elevated by public PoC visibility and vendor non-response (no patch), but lacking evidence of widespread or active exploitation.

An attacker causes a vulnerable O-KAM Client 1.3.3.32 to process crafted input handled by FUN_10003EA0 in DevDll_925.dll, overflowing a stack buffer and corrupting adjacent stack memory. A public PoC reference exists on a GitHub gist but it is not verified as working exploit code, and the exact trigger path is not described in the available sources. Given AV:N/AC:L/PR:N, no authentication is required, though the only-Low impact ratings suggest the achievable effect may be constrained (e.g., crash or limited corruption) rather than reliable code execution.