Submit #1016302: Shenzhen VStarcam Technology Co., Ltd O-KAM SuperIPCam 1.3.3.32 CWE-416 + CWE-362: Use-After-Free Race Condition

O-KAM SuperIPCam.exe contains a use-after-free race condition
(CWE-416 + CWE-362) in the P2P session teardown path.

FUN_005a2d44 tears down the session object without holding the
critical section that protects it. A concurrent sample callback
(FUN_005a2e90) acquires the same critical section and reads
state that the destroy path is freeing. Under a targeted message
flood, the race collapses the process heap and triggers a
null-pointer dereference inside SuperIPCam.exe.

Affected functions:

FUN_005a2d44 — session destroy path (race, no lock held)
FUN_005a2e90 — sample callback (reads freed state)
FUN_005a2a44 — background thread (correct lock pattern,
for contrast)

Live crash observed:

Target: D:\softwares\O-KAM\SuperIPCam.exe
Trigger: targeted message flood (5000 iterations)
Result: heap collapse (mem drops from ~36 MB to 20 KB at
iteration 1500), followed by:
Access violation at address 006D2CE2
in module 'SuperIPCam.exe'
Read of address 00000000

0x006D2CE2 = RVA 0x2D2CE2 — inside SuperIPCam.exe, not in a
third-party DLL. The null-read is consistent with a freed
object whose vtable/field table was zeroed during teardown.

Additional confirmation:

- Go race detector: 4x DATA RACE warnings on the pattern
- Isolated C model: 100% crash rate, 0xC0000374
(STATUS_HEAP_CORRUPTION)

Reachability:

Remote peer (rogue camera / MITM)
P2P session teardown message
FUN_005a2d44 (destroy without lock)
concurrent FUN_005a2e90 (sample callback reader)
heap corruption / null-pointer dereference

No local access is required on the victim side. The client
only needs to be connected to a P2P session.

CVSS 3.1: 7.5 High
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Fix: hold the critical section before teardown:

EnterCriticalSection(s->cs);
(*s->vtable->stop)(s);
teardown(s);
LeaveCriticalSection(s->cs);
DeleteCriticalSection(s->cs);

Or use refcounting so the object lives until all readers exit.

Analyst: ishanoshada — https://github.com/ishanoshada

• Source: ⚠️ https://gist.github.com/Ishanoshada/cb73d61f792c77767338568501b135c9
• User: Anonymous User
• Submission: 10/06/2026 18:32 (26 days ago)
• Moderation: 11/01/2026 15:36 (26 days later)
• Status: Accepted
• VulDB entry: 429662 [VStarcam O-KAM SuperIPCam 1.3.3.32 P2P Session Teardown SuperIPCam.exe FUN_005a2d44 use after free]
• Points: 20