Buffer Overflow Vulnerability in ZoneMinder from ZoneMinder Developers
CVE-2026-102296

8.3HIGH

Key Information:

Vendor

Zoneminder

Status
Zoneminder
Vendor
CVE Published:
28 September 2026

What is CVE-2026-102296?

ZoneMinder prior to version 1.38.4 contains static buffer overflow vulnerabilities that may be exploited by malicious HTTP cameras or attackers intercepting traffic. By sending oversized response headers—including status messages and Content-Type values—an attacker can manipulate the state of the parser, potentially causing crashes or memory corruption. This vulnerability highlights the need for stringent validation of HTTP responses from cameras to ensure system integrity.

Affected Version(s)

zoneminder 0 < 1.38.4

zoneminder 1.38.4

References

https://github.com/ZoneMinder/zoneminder/commit/2596e5fb6...
patch
https://github.com/ZoneMinder/zoneminder
product
https://github.com/ZoneMinder/zoneminder/security/advisor...
vendor-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

TristanInSec
leediay153
.