The flaw resides in the P2P Session Teardown routine within SuperIPCam.exe of VStarcam O‑KAM SuperIPCam 1.3.3.32. An attacker can craft input to trigger a use‑after‑free condition after the function FUN_005a2d44 releases the session object. The result is memory corruption that, if successful, can allow an attacker to execute arbitrary code on the camera. The CVE description does not confirm code execution, but the nature of the defect strongly implies that exploitation could lead to remote code execution or privilege escalation.

VStarcam O‑KAM SuperIPCam 1.3.3.32, the affected component is the executable SuperIPCam.exe. This version is the only one noted as vulnerable; no other releases are listed in the advisory.

The CVSS score of 6.9 places the vulnerability in the moderate range, and the EPSS score is not available. The issue is not present in CISA's KEV catalog. It can be triggered from outside the network, meaning a remote attacker can initiate the exploit by connecting to the device over the P2P channel. Because the attacker is not required to authenticate locally, the likelihood of exploitation in the wild is non‑negligible if the camera is exposed to untrusted networks.