Wyze Cam Pan v3 / TUTK SDK — tutk_packet_alloc Heap Overflow (CVE-2026-38698)

Metadata

Affected Target

Summary

The tutk_packet_alloc function inside the TUTK SDK’s tutk_av_server component, used by Wyze Cam Pan v3 and other TUTK-integrated IoT cameras, allocates a buffer for incoming AV packets based on an attacker-influenced size field without adequate bounds validation. An authenticated attacker able to reach the device’s TUTK P2P/AV service (port 32761) can send a crafted, oversized AV packet derived from a decrypted UDP payload to trigger a heap buffer overflow. The repository provides the C source for both the packet decryptor (used to analyze/craft the proprietary TUTK protocol payloads) and the exploit that sends the malformed packet, along with a written report and demonstration video.

Vulnerability Details

Root Cause

tutk_packet_alloc() computes an allocation size from an attacker-controlled field in a decrypted AV packet without validating it against the actual received/expected data length, leading to a heap buffer overflow when the packet is subsequently copied (CWE-122-class heap overflow).

Attack Vector

1. Establish an authenticated TUTK session with the target camera’s AV service on UDP port 32761.
2. Use the included decryptor tooling to construct a valid encrypted AV packet envelope.
3. Craft the packet’s payload/size fields to be oversized relative to what tutk_packet_alloc expects.
4. Send the malicious packet to the device, triggering a heap overflow in tutk_av_server.

Impact

Memory corruption on the camera’s embedded Linux/RTOS platform, with the potential for remote code execution on the device depending on heap layout and mitigations present in the target firmware.

Environment / Lab Setup

Target:   TUTK SDK v3.1.10.0 - v4.3.8.1 (e.g. Wyze Cam Pan v3 firmware)
Attacker: gcc, make, libssl/libcrypto (pkg-config), authenticated TUTK session material

Proof of Concept

PoC Script

See exploit/src/ (main.c, charlie.c, iotc_client.c, util.c) and exploit/Makefile in this folder.

1
2
3

cd exploit
make
./exploit <target parameters>

Building with the provided Makefile compiles both a release (exploit) and debug (exploit-debug) binary that establish a TUTK session with the target device and transmit the oversized AV packet to trigger the tutk_packet_alloc heap overflow.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected reboots or watchdog resets of TUTK-based cameras shortly after inbound P2P/AV traffic
• Anomalously large or malformed AV packets observed on UDP port 32761 in network captures

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/vital-information-resource-under-siege/CVE-2026-38698-and-CVE-2026-38699 on 2026-07-05. Only the CVE-2026-38698 PoC sources (C source, headers, Makefile) were mirrored; the accompanying PDF report, .gdb_history session file, and pre-compiled binaries were omitted for size/hygiene reasons — see the source repository for the full research artifact and CVE-2026-38699 (OOB read) materials.