{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/throughtek/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-38698"},{"id":"CVE-2026-38699"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TUTK SDK (v.3.1.10.0 through v.4.3.8.1)"],"_cs_severities":["medium"],"_cs_tags":["iot","vulnerability","cve"],"_cs_type":"advisory","_cs_vendors":["ThroughTek"],"content_html":"\u003cp\u003eThroughTek (TUTK) SDK versions 3.1.10.0 through 4.3.8.1 contain two distinct vulnerabilities: a heap overflow (CVE-2026-38698) and an out-of-bounds read (CVE-2026-38699). CVE-2026-38698 occurs within the tutk_packet_alloc function when processing an oversized AV packet sent to UDP port 32761, requiring an authenticated attacker. CVE-2026-38699 exists in the __Fill_ReadBuf function and can be triggered by a local attacker sending a UDP packet with an invalid payload offset. These SDK vulnerabilities affect various IoT products, including the Wyze Cam Pan. Proof-of-concept code has been publicly released.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-38698 may result in memory corruption via heap overflow, potentially leading to arbitrary code execution. CVE-2026-38699 may cause memory access issues, likely resulting in service crashes or unauthorized memory exposure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify IoT devices within the environment utilizing the affected TUTK SDK versions (3.1.10.0 to 4.3.8.1).\u003c/li\u003e\n\u003cli\u003ePrioritize firmware updates from device manufacturers that incorporate patched versions of the TUTK SDK.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to restrict access to IoT device communication ports, specifically UDP port 32761, from untrusted segments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T20:28:11Z","date_published":"2026-10-24T20:28:11Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tutk-sdk-vulnerabilities/","summary":"Public proof-of-concept exploits are available for two vulnerabilities in the ThroughTek TUTK SDK (v3.1.10.0-4.3.8.1) that could allow remote heap overflow and out-of-bounds read conditions in downstream IoT devices.","title":"ThroughTek TUTK SDK: Heap Overflow and Out-of-Bounds Read (CVE-2026-38698 and CVE-2026-38699)","url":"https://feed.craftedsignal.io/briefs/2026-10-tutk-sdk-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - ThroughTek","version":"https://jsonfeed.org/version/1.1"}