ThroughTek TUTK SDK: Heap Overflow and Out-of-Bounds Read (CVE-2026-38698 and CVE-2026-38699)
Public proof-of-concept exploits are available for two vulnerabilities in the ThroughTek TUTK SDK (v3.1.10.0-4.3.8.1) that could allow remote heap overflow and out-of-bounds read conditions in downstream IoT devices.
CVE search metadata
CVE search record: CVE-2026-38698. KEV: no. Product: TUTK SDK (v.3.1.10.0 through v.4.3.8.1). Brief: ThroughTek TUTK SDK: Heap Overflow and Out-of-Bounds Read (CVE-2026-38698 and CVE-2026-38699). Brief link: https://feed.craftedsignal.io/briefs/2026-10-tutk-sdk-vulnerabilities/
CVE search record: CVE-2026-38699. KEV: no. Product: TUTK SDK (v.3.1.10.0 through v.4.3.8.1). Brief: ThroughTek TUTK SDK: Heap Overflow and Out-of-Bounds Read (CVE-2026-38698 and CVE-2026-38699). Brief link: https://feed.craftedsignal.io/briefs/2026-10-tutk-sdk-vulnerabilities/
Triage facts
Revision 1- Applicability
- TUTK SDK (v.3.1.10.0 through v.4.3.8.1)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 24, 20:28 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- B3Roughly even chance
ThroughTek (TUTK) SDK versions 3.1.10.0 through 4.3.8.1 contain two distinct vulnerabilities: a heap overflow (CVE-2026-38698) and an out-of-bounds read (CVE-2026-38699). CVE-2026-38698 occurs within the tutk_packet_alloc function when processing an oversized AV packet sent to UDP port 32761, requiring an authenticated attacker. CVE-2026-38699 exists in the __Fill_ReadBuf function and can be triggered by a local attacker sending a UDP packet with an invalid payload offset. These SDK vulnerabilities affect various IoT products, including the Wyze Cam Pan. Proof-of-concept code has been publicly released.
Impact
Successful exploitation of CVE-2026-38698 may result in memory corruption via heap overflow, potentially leading to arbitrary code execution. CVE-2026-38699 may cause memory access issues, likely resulting in service crashes or unauthorized memory exposure.
Recommendation
- Identify IoT devices within the environment utilizing the affected TUTK SDK versions (3.1.10.0 to 4.3.8.1).
- Prioritize firmware updates from device manufacturers that incorporate patched versions of the TUTK SDK.
- Implement network segmentation to restrict access to IoT device communication ports, specifically UDP port 32761, from untrusted segments.
Immediate actions
Inventory all IoT devices, specifically Wyze cameras, to identify those utilizing the vulnerable TUTK SDK.
Threat Hunt
Monitor network traffic for anomalous UDP volume or malformed packets directed toward port 32761 on IoT devices.
Data: Network flow logs or PCAP
Mitigations
Apply manufacturer-provided firmware updates for affected IoT hardware.
CVE-2026-38698, CVE-2026-38699