An out-of-bounds memory access flaw allows a buffer overflow on the heap, enabling an attacker to overwrite critical control data. In practice this can lead to arbitrary code execution or severe disruption of the camera’s operation, compromising confidentiality, integrity, and availability of the device.

The vulnerability affects a wide range of Milesight AIOT camera models, including, but not limited to, MS-C2964-RFLPC, MS-C2966-RFLWPC, MS-C2966-X12RLPC, MS-C2972-RFLPC, MS-C5321-FPE, MS-C5366-X12LPC, and numerous others listed in the vendor’s advisory. All firmware versions prior to the updates specified by Milesight are considered vulnerable.

The CVSS score of 8.6 classifies this flaw as high severity. EPSS data is not available, but the flaw’s nature and the extensive device list raise concerns for potential exploitation via network traffic. The vulnerability is not currently catalogued in CISA’s KEV list. The likely attack vector is remote, accessed through network interfaces that the camera exposes, although an attacker must have the ability to deliver crafted input to trigger the overflow.