CVE-2026-52656 is a critical remote code execution vulnerability affecting SJCAM AllWinner Tech SJ4000-Air firmware version 1.4C and earlier, including Whitelabel variants. The flaw arises from improper handling of crafted FEX files, enabling attackers to execute arbitrary code without authentication or user interaction. The vulnerability is classified under CWE-94, indicating unsafe code generation or execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

Successful exploitation allows remote attackers to execute arbitrary code on affected devices, potentially leading to full system compromise, data disclosure, and denial of service. The vulnerability impacts confidentiality, integrity, and availability with a critical severity rating (CVSS 9.8). This could enable attackers to control the device remotely without any authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted FEX files and restrict access to device management interfaces to trusted networks only.