Submit #1016301: Shenzhen VStarcam Technology Co., Ltd O-KAM Client (DevDll_925.dll) 1.3.3.32 CWE-121: Stack-based Buffer Overflow

DevDll_925.dll, part of the O-KAM client, contains a
stack-based buffer overflow (CWE-121) in the function
FUN_10003EA0 at RVA 0x3EA0.

FUN_10003EA0 copies four caller-controlled strings into
fixed-size stack buffers using lstrcpyA with no length
validation. Each source string is populated by an unbounded
setter that is reachable from the P2P SetDeviceInfo message
handler. A rogue camera or MITM on the P2P session can
overwrite the stack canary and the saved return address,
yielding a full EIP-control primitive in the target process.

Affected buffers and their sources:

local_418[1028] <- serial this+0x114 set by FUN_10004b50(arg 1)
local_45c[64] <- IP this+0x14c set by FUN_10004b50(arg 2)
local_59c[256] <- auth this+0x16c set by FUN_10004af0(arg 1)
local_49c[64] <- prefix this+0x188 set by FUN_10004af0(arg 2)

Each copy uses the MSVC std::string SSO-dereference pattern
with no bounds check against the destination size:

p = (LPCSTR)((int)this + 0xNN);
if (0xf < *(uint *)((int)this + 0xNN + 0x14))
p = *(LPCSTR *)p;
lstrcpyA(local_XXX, p); /* no target-size argument */

All four buffers are independently exploitable. A test
harness that loads the DLL and calls FUN_10003EA0 with a
crafted object triggers STATUS_STACK_BUFFER_OVERRUN
(0xC0000409) in all four cases:

test.exe DevDll_925.dll 0 1031 serial -> 0xC0000409
test.exe DevDll_925.dll 1 1099 IP -> 0xC0000409
test.exe DevDll_925.dll 2 1419 auth -> 0xC0000409
test.exe DevDll_925.dll 3 1163 prefix -> 0xC0000409

0xC0000409 is a fastfail raised by __security_check_cookie.
It is not catchable with SEH or try/except; the child process
is terminated by the kernel.

Reachability:

Remote peer (rogue camera / MITM)
P2P SetDeviceInfo message
FUN_10004b50 / FUN_10004af0 unbounded string stores
FUN_10003EA0 unbounded lstrcpyA x4
__security_check_cookie -> fastfail

No local code execution is required on the victim side. The
client only needs to be connected to a P2P session, which is
its normal operating mode.

CVSS 3.1: 9.0 Critical
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix: replace the four lstrcpyA calls with bounded copies
(StringCchCopyA / strncpy_s / lstrcpynA) and cap the source
strings at the setter layer (FUN_10004b50 / FUN_10004af0)
before storing them.

SHA256 of tested binary: <paste-64-hex>

Analyst: ishanoshada — https://github.com/ishanoshada

• Source: ⚠️ https://gist.github.com/Ishanoshada/f6345a42a46e1345e6c7400aac311d77
• User: Anonymous User
• Submission: 10/06/2026 18:29 (26 days ago)
• Moderation: 11/01/2026 15:36 (26 days later)
• Status: Accepted
• VulDB entry: 429661 [VStarcam O-KAM Client 1.3.3.32 DevDll_925.dll FUN_10003EA0 stack-based overflow]
• Points: 20