An out‑of‑bounds memory read occurs in the TuyaIoT component of the arduino‑TuyaOpen SDK before version 1.2.1. When a device receives specially crafted DP event data from a compromised or hijacked Tuya cloud service, the component accesses memory outside its bounds. This flaw is classified as CWE‑125. Resulting behaviors include the disclosure of the device's internal memory contents to an attacker and, in some cases, a denial‑of‑service condition that causes the device to crash or become unresponsive.

Product: arduino‑TuyaOpen by Tuya. All releases older than 1.2.1 are affected. The advisory indicates that any device running the library prior to that version is vulnerable, while version 1.2.1 and later fix the issue.

The CVSS score is 7.0, indicating a medium severity. The EPSS is below 1%, suggesting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control or hijack the Tuya cloud infrastructure to push malicious DP data to the device. When such access is available, triggering the memory read is straightforward and may leak sensitive data or disrupt device operation.