# CVE-2026-33361: Meari IoT SDK weak XOR obfuscation in image handling

Source: https://junglewise.ai/threats/cve-2026-33361-meari-iot-sdk-weak-xor-obfuscation-in-image-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-33361 · Severity: high · CVSS 7.5 · Published 2026-05-11

A vulnerability in the Meari IoT SDK, used by popular baby monitor apps like CloudEdge and Arenti, allows unauthorized viewing of private images. The software uses a weak and predictable method to "scramble" photos instead of using strong encryption. This means that if an attacker gains access to the stored image files, they can easily convert them back into viewable photos, leading to a significant privacy breach for families using these devices.

Technologies: [Meari IoT SDK](https://junglewise.ai/threats/technologies/iot-sdk). Vendors: [Meari](https://junglewise.ai/threats/vendors/meari).

## Quick answers

**Is CVE-2026-33361 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33361 being exploited in the wild.

**How severe is CVE-2026-33361?** High severity, with a CVSS score of 7.5, published 11 May 2026.

**Which products and versions are affected?** Meari CloudEdge 5.5.0 (build 220); Meari IoT SDK <= 1.8.x.

**Is there a fix for CVE-2026-33361?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33361 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33361?** Check whether you run Meari CloudEdge or Meari IoT SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the image handling component (libmrplayer.so) of the Meari IoT SDK. Specifically, '.jpgx3' files are protected using a reversible XOR operation applied only to the first 1024 bytes of the file. The key derivation model used for this operation is predictable, failing to provide robust cryptographic security (CWE-326). An attacker who obtains these files—potentially through other vulnerabilities like unauthenticated storage exposure—can programmatically reverse the obfuscation to recover the original JPEG images. This affects Meari-based white-label applications including CloudEdge and Arenti.

## Affected products

- Meari IoT SDK (libmrplayer.so) <= 1.8.x
- Meari CloudEdge 5.5.0 (build 220)
- Arenti Arenti 1.8.1 (build 220)

## Timeline

- 2026-03-11: disclosed: Issues identified by researcher and disclosed to vendor
- 2026-04-03: other: Opened VINCE Case VU#579666 with CISA
- 2026-05-11: advisory: Public disclosure of vulnerability

## References

- [https://github.com/xn0tsa/nobody-puts-baby-in-a-corner](https://github.com/xn0tsa/nobody-puts-baby-in-a-corner)
- [https://www.runzero.com/advisories/meari-weak-xor-obfuscation-cve-2026-33361/](https://www.runzero.com/advisories/meari-weak-xor-obfuscation-cve-2026-33361/)

## Related threats

- [Meari IoT SDK hardcoded cryptographic keys in Android apps](https://junglewise.ai/threats/cve-2026-33362-meari-iot-sdk-hardcoded-cryptographic-keys-in-android-apps)
- [Meari IoT SDK missing authorization in OpenAPI device status endpoint](https://junglewise.ai/threats/cve-2026-33357-meari-iot-sdk-missing-authorization-in-openapi-device-status)