Buffer overflow in ZoneMinder - CVE-2026-102296
Published: November 3, 2026
Vulnerability identifier: #VU158953
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102296
CWE-ID: CWE-120
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to corrupt memory, potentially compromising sensitive information and data integrity.
The vulnerability exists due to unchecked buffer copies in the non-PCRE HTTP response parser in RemoteCameraHTTP::GetResponse() when processing camera response headers. A remote attacker can supply oversized HTTP status messages or header values through a malicious configured camera or interception of camera traffic to overflow fixed-size static buffers and corrupt adjacent parser state, potentially compromising sensitive information and data integrity.
The affected parser is used by default when ZoneMinder is built without PCRE support.
Affected software
ZoneMinder
How to mitigate CVE-2026-102296
Install security update from vendor's website.
ZoneMinder - update to 1.38.4