TUTK SDK (V.3.1.10.0 Through V.4.3.8.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/tutk-sdk-v.3.1.10.0-through-v.4.3.8.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 20:28:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgThroughTek TUTK SDK: Heap Overflow and Out-of-Bounds Read (CVE-2026-38698 and CVE-2026-38699)https://feed.craftedsignal.io/briefs/2026-10-tutk-sdk-vulnerabilities/Sat, 24 Oct 2026 20:28:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-tutk-sdk-vulnerabilities/Public proof-of-concept exploits are available for two vulnerabilities in the ThroughTek TUTK SDK (v3.1.10.0-4.3.8.1) that could allow remote heap overflow and out-of-bounds read conditions in downstream IoT devices.ThroughTek (TUTK) SDK versions 3.1.10.0 through 4.3.8.1 contain two distinct vulnerabilities: a heap overflow (CVE-2026-38698) and an out-of-bounds read (CVE-2026-38699). CVE-2026-38698 occurs within the tutk_packet_alloc function when processing an oversized AV packet sent to UDP port 32761, requiring an authenticated attacker. CVE-2026-38699 exists in the __Fill_ReadBuf function and can be triggered by a local attacker sending a UDP packet with an invalid payload offset. These SDK vulnerabilities affect various IoT products, including the Wyze Cam Pan. Proof-of-concept code has been publicly released.

Impact

Successful exploitation of CVE-2026-38698 may result in memory corruption via heap overflow, potentially leading to arbitrary code execution. CVE-2026-38699 may cause memory access issues, likely resulting in service crashes or unauthorized memory exposure.

Recommendation

  • Identify IoT devices within the environment utilizing the affected TUTK SDK versions (3.1.10.0 to 4.3.8.1).
  • Prioritize firmware updates from device manufacturers that incorporate patched versions of the TUTK SDK.
  • Implement network segmentation to restrict access to IoT device communication ports, specifically UDP port 32761, from untrusted segments.
]]>mediumadvisoryiotvulnerabilitycve