CVE-2019-12266: Stack buffer overflow in Wyze Cam Pan v2, Cam v2 and Cam v3

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-30 · updated 2026-06-17
Weakness: CWE-121

Description

Stack-based Buffer Overflow vulnerability in Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to run arbitrary code on the affected device. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8.1002. Wyze Cam v3 versions prior to 4.36.8.32.

Affected products

Wyze Cam Pan V2 Firmware: before 4.49.1.47 — fixed in 4.49.1.47
Wyze Cam V2 Firmware: before 4.9.8.1002 — fixed in 4.9.8.1002
Wyze Cam v3: before 4.36.8.32 — fixed in 4.36.8.32

How to fix

Upgrade to a fixed version: Wyze Cam Pan V2 Firmware 4.49.1.47; Wyze Cam V2 Firmware 4.9.8.1002; Wyze Cam v3 4.36.8.32. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-12266 or the next vulnerability affects your stack