CVE-2026-120226
Hangzhou Xiongmai Technology P2PAPI.dll P2P SDK P2PAPI_Connect buffer overflow
- State
- Published
- Severity
- 4.8 Medium
- Published
- Nov 1, 2026
- Updated
- Nov 1, 2026
- Reserved
- Oct 31, 2026
Description
A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows. Affected by this issue is the function P2PAPI_Connect of the component P2P SDK. Such manipulation of the argument input as part of String leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.3 Low | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:T/RC:C | VulDB |
| 3.0 | 3.3 Low | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:T/RC:C | VulDB |
| 2.0 | 1.7 Low | AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:TF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
P2PAPI.dllHangzhou Xiongmai Technology |
|
References
- VDB-429585 | Hangzhou Xiongmai Technology P2PAPI.dll P2P SDK P2PAPI_Connect buffer overflowvdb-entrytechnical-descriptionmitigation
- VDB-429585 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-120226 | CVE Analysis and Reportthird-party-advisory
- Submit #1013929 | Hangzhou Xiongmai Technology Co., Ltd P2PAPI.dll 1.3.3.32 CWE-120: Buffer Copy without Checking Size of Inputthird-party-advisory
- https://gist.github.com/Ishanoshada/a47d24d77dd03f34c7f324491b59edacmitigation
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.