An out-of-bounds memory access vulnerability (CWE-122) exists in certain firmware versions of the Milesight MS-Cxx63-PD AIOT cameras. This vulnerability can be triggered remotely without authentication, leading to potential memory corruption that impacts confidentiality, integrity, and availability. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No official remediation or patch has been disclosed by the vendor yet. The vulnerability was published on 2026-04-27 and is tracked as CVE-2026-20766.

The vulnerability allows remote unauthenticated attackers to cause out-of-bounds memory access, which can lead to memory corruption affecting the confidentiality, integrity, and availability of the affected device. This could result in denial of service or potentially unauthorized access or control depending on exploitation specifics. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation has been published, users should monitor Milesight's security advisories closely. Until a patch is available, consider limiting network exposure of affected devices and applying network-level protections to reduce attack surface.