VStarcam SuperIPCam EUVD-2026-115061

Exploitation requires network reachability to the affected software's P2P connectivity feature (the P2P Session Teardown component in SuperIPCam.exe); the vulnerability is triggered during P2P session teardown handling in function FUN_005a2d44, so the target must have P2P cloud/remote-access functionality active, which is the default operating mode for VStarcam O-KAM cameras. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N), so a remote unauthenticated attacker able to reach the P2P service can attempt the trigger. The exact packet sequence or state manipulation that frees-then-reuses the object is not described in the available sources, so the precise trigger is unverified. Limiting factors: exploitation depends on exposure of the P2P service to the attacker (deployments that isolate the device from the P2P path reduce reach), it affects only version 1.3.3.32, and the observed impact is low/partial, consistent with a denial-of-service crash rather than confirmed code execution.

This is a medium-severity issue (vendor CVSS 4.0 base 6.9) rather than a top-tier emergency, and the signals are broadly consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely reachable flaw requiring no authentication and no user interaction, which raises exploitability, but the impact metrics are all low (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N) and the tag set emphasizes Denial Of Service, so the realistic outcome of this use-after-free is most likely a service crash with limited memory corruption rather than confirmed remote code execution. Exploit maturity is E:P (proof-of-concept), matching the input note that only a non-verified PoC reference exists; there is no evidence of weaponized or automated exploitation. The vuln.today decision label is 'this_month', not act_now/emergency, supporting a scheduled-remediation posture. Key signals are MISSING: no EPSS score is provided, so exploitation probability cannot be quantified, and there is no CISA KEV entry, so there is no evidence of active exploitation. Confidence is further limited by single-source reporting (VulDB only) and an unresponsive vendor, which means no patch is currently available - this raises operational risk relative to the modest CVSS because defenders cannot simply apply a fix.

A remote attacker who can reach the camera software's P2P networking service sends crafted traffic that abuses the P2P session teardown path, triggering a use-after-free in function FUN_005a2d44 of SuperIPCam.exe. Because the flaw is network-reachable without authentication (PR:N), the most plausible result is a crash of the service (denial of service) with possible limited memory corruption; reliable code execution is not established by the available sources. A public PoC reference exists (a gist) but it is not verified as working exploit code.