# CVE-2026-61390: Hikvision Cameras heap buffer overflow in DS-2CD and DS-2DE series

Source: https://junglewise.ai/threats/cve-2026-61390-hikvision-cameras-heap-buffer-overflow-in-ds-2cd-and-ds-2de  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-61390 · Severity: high · CVSS 7.7 · Published 2026-07-22

A security vulnerability has been identified in certain Hikvision security cameras that could allow an unauthorized person to disrupt the device's operation. By sending specifically designed network traffic, an attacker can cause the camera to malfunction or crash, potentially leading to a loss of video surveillance and security monitoring. This issue affects the DS-2CD and DS-2DE series of cameras, which are widely used for physical security and facility oversight.

Technologies: [Hikvision DS-2CD Series](https://junglewise.ai/threats/technologies/ds-2cd-series), [Hikvision DS-2DE Series](https://junglewise.ai/threats/technologies/ds-2de-series). Vendors: [Hikvision](https://junglewise.ai/threats/vendors/hikvision).

## Quick answers

**Is CVE-2026-61390 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61390 being exploited in the wild.

**How severe is CVE-2026-61390?** High severity, with a CVSS score of 7.7, published 22 July 2026.

**Which products and versions are affected?** Hikvision DS-2CD Series; Hikvision DS-2DE Series.

**Is there a fix for CVE-2026-61390?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-61390 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-61390?** Check whether you run Hikvision DS-2CD Series or Hikvision DS-2DE Series. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer overflow vulnerability exists in the firmware of certain Hikvision cameras, specifically within the DS-2CD and DS-2DE product lines. The flaw is triggered when the device processes specially crafted network packets sent by an unauthenticated attacker. While the attack complexity is rated as high, a successful exploit can lead to a device crash (denial of service) or potentially broader system instability. The vulnerability is reachable over the network without requiring user interaction or prior authentication. Hikvision has released a security advisory directing users to their firmware download portal for updates.

## Affected products

- Hikvision DS-2CD Series
- Hikvision DS-2DE Series

## Timeline

- 2026-07-22: disclosed
- 2026-07-22: advisory

## References

- [https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikvision-cameras/](https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikvision-cameras/)

## Related threats

- [Hikvision DS-2CD and DS-2DE Series information disclosure](https://junglewise.ai/threats/cve-2026-61392-hikvision-ds-2cd-and-ds-2de-series-information-disclosure)
- [Hikvision DS-2CD and DS-2DE Series stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-61391-hikvision-ds-2cd-and-ds-2de-series-stack-based-buffer-overflow)
- [Hikvision Camera Series improper input validation in firmware](https://junglewise.ai/threats/cve-2026-57600-hikvision-camera-series-improper-input-validation-in-firmware)