CVE-2026-31256 Null dereference in n/a

High 7.5 Published 27 Apr 2026 Updated 28 Apr 2026

An attacker can crash and reboot the MERCURY IP camera by sending a malformed RTSP SETUP request, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-31256?

CVE-2026-31256 is a high-severity vulnerability in n/a, published on 27 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A null pointer dereference vulnerability exists in the RTSP service of the MERCURY MIPC252W 1.0.5 Build 230306 Rel.79931n. During the processing of a SETUP request for the path rtsp://<IP>:554/stream1/track2, the device fails to properly validate the Transport header field. When this header is improperly constructed, the RTSP service can dereference a NULL pointer during request parsing. Successful exploitation causes the device to crash and automatically reboot.

Weakness: CWE-476

Which versions are affected by CVE-2026-31256?

It affects 1 product.

Products include Mercurycom Mipc252w Firmware.

How do I fix CVE-2026-31256?

No fix has been published for CVE-2026-31256 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-31256 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31256 exists.

Sources

Also known as GHSA-jhq8-6g6m-wm24.