CVE-2026-33361 Meari weak XOR obfuscation
Attackers can decrypt baby monitor images due to weak XOR obfuscation in the Meari IoT SDK, exposing sensitive visual data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33361?
CVE-2026-33361 is a high-severity vulnerability in com.meari.sdk, published on 11 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor ".jpgx3" files use reversible XOR over only the first 1024 bytes with a predictable key derivation model.
Weakness: CWE-326
Which versions are affected by CVE-2026-33361?
How do I fix CVE-2026-33361?
No fix has been published for CVE-2026-33361 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-33361 being exploited?
There is no known exploitation of CVE-2026-33361 in the wild and no public exploit code.
Sources
Also known as GHSA-pfqv-vhwj-2rjw.