Vulnerability · Published Apr 27, 2026 · Assigned by icscert
CVE-2026-20766Milesight Cameras Heap-based Buffer Overflow
High 8.8
In plain English
A high-severity heap buffer overflow in MS-C2964-RFLPC from Milesight. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 78.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Milesight | MS-Cxx63-PD | 0 – through 51.7.0.77-r12 |
| Milesight | MS-Cxx64-xPD | 0 – through 51.7.0.77-r12 |
| Milesight | MS-Cxx73-xPD | 0 – through 51.7.0.77-r12 |
| Milesight | MS-Cxx75-xxPD | 0 – through 51.7.0.77-r12 |
| Milesight | MS-Cxx83-xPD | 0 – through 51.7.0.77-r12 |
| Milesight | MS-Cxx74-PA | 0 – through 3x.8.0.3-r11 |
| Milesight | MS-C8477-HPG1 | 0 – through 63.8.0.4-r3 |
| Milesight | MS-C8477-PC | 0 – through 48.8.0.4-r3 |
| Milesight | MS-C5321-FPE | 0 – through 62.8.0.4-r5 |
| Milesight | MS-Cxx72-xxxPE | 0 – through 61.8.0.5-r2 |
| Milesight | MS-Cxx62-xxxPE | 0 – through 61.8.0.5-r2 |
| Milesight | MS-Cxx52-xxxPE | 0 – through 61.8.0.5-r2 |
| Milesight | MS-Cxx66-xxxPE | 0 – through 61.8.0.5-r2 |
| Milesight | MS-Cxx66-xxxGPE | 0 – through 61.8.0.5-r2 |
| Milesight | MS-Cxx61-xxxPE | 0 – through 61.8.0.5-r2 |
| Milesight | MS-Cxx67-xxxPE | 0 – through 61.8.0.5-r2 |
| Milesight | MS-Cxx71-xxxPE | 0 – through 61.8.0.5-r2 |
| Milesight | MS-Cxx41-xxxPE | 0 – through 61.8.0.5-r2 |
| Milesight | MS-Cxx76-PE | 0 – through 61.8.0.5-r2 |
| Milesight | MS-Cxx65-PE | 0 – through 61.8.0.5-r2 |
| Milesight | MS-Cxx66-xxxG1 | 0 – through 63.8.0.5-r3 |
| Milesight | MS-Cxx62-xxxG1 | 0 – through 63.8.0.5-r3 |
| Milesight | MS-Cxx72-xxxG1 | 0 – through 63.8.0.5-r3 |
| Milesight | MS-CQxx31-xxxG1 | 0 – through CQ_63.8.0.5-r1 |
| Milesight | MS-CQxx68-xxxG1 | 0 – through CQ_63.8.0.5-r1 |
| Milesight | MS-CQxx72-xxxG1 | 0 – through CQ_63.8.0.5-r1 |
| Milesight | MS-Nxxxx-NxE | 0 – through 7x.9.0.19-r5 |
| Milesight | MS-Nxxxx-xxC | 0 – through 7x.9.0.19-r5 |
| Milesight | MS-Nxxxx-xxE | 0 – through 7x.9.0.19-r5 |
| Milesight | MS-Nxxxx-xxG | 0 – through 7x.9.0.19-r5 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H