Is CVE-2026-33361 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33361 being exploited in the wild.

How severe is CVE-2026-33361?

High severity, with a CVSS score of 7.5, published 11 May 2026.

Which products and versions are affected?

Meari CloudEdge 5.5.0 (build 220); Meari IoT SDK <= 1.8.x.

Is there a fix for CVE-2026-33361?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33361 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33361?

Check whether you run Meari CloudEdge or Meari IoT SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33361: Meari IoT SDK weak XOR obfuscation in image handling

Q: Is there a fix for CVE-2026-33361?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-33361 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-33361?

Check whether you run Meari CloudEdge or Meari IoT SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33361 · Severity: high · CVSS 7.5 · Published 2026-05-11

A vulnerability in the Meari IoT SDK, used by popular baby monitor apps like CloudEdge and Arenti, allows unauthorized viewing of private images. The software uses a weak and predictable method to "scramble" photos instead of using strong encryption. This means that if an attacker gains access to the stored image files, they can easily convert them back into viewable photos, leading to a significant privacy breach for families using these devices.

Technologies: Meari IoT SDK. Vendors: Meari.

Quick answers

Is CVE-2026-33361 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33361 being exploited in the wild.
How severe is CVE-2026-33361?: High severity, with a CVSS score of 7.5, published 11 May 2026.
Which products and versions are affected?: Meari CloudEdge 5.5.0 (build 220); Meari IoT SDK <= 1.8.x.
Is there a fix for CVE-2026-33361?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33361 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33361?: Check whether you run Meari CloudEdge or Meari IoT SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the image handling component (libmrplayer.so) of the Meari IoT SDK. Specifically, '.jpgx3' files are protected using a reversible XOR operation applied only to the first 1024 bytes of the file. The key derivation model used for this operation is predictable, failing to provide robust cryptographic security (CWE-326). An attacker who obtains these files—potentially through other vulnerabilities like unauthenticated storage exposure—can programmatically reverse the obfuscation to recover the original JPEG images. This affects Meari-based white-label applications including CloudEdge and Arenti.

Affected products

Meari IoT SDK (libmrplayer.so) <= 1.8.x
Meari CloudEdge 5.5.0 (build 220)
Arenti Arenti 1.8.1 (build 220)

Timeline

2026-03-11: disclosed: Issues identified by researcher and disclosed to vendor
2026-04-03: other: Opened VINCE Case VU#579666 with CISA
2026-05-11: advisory: Public disclosure of vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.