ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Zoneminder
  • Zoneminder

No data.

No data.

References
Link Providers
https://github.com/ZoneMinder/zoneminder cve-icon cve-icon
https://github.com/ZoneMinder/zoneminder/blob/1.38.3/src/zm_remote_camera_http.cpp#L736 cve-icon cve-icon
https://github.com/ZoneMinder/zoneminder/commit/2596e5fb64c0348e615577b0ab08dc38b6dc6ed8 cve-icon cve-icon
https://github.com/ZoneMinder/zoneminder/commit/813bf6f1a3ffc92c163352f2480477ba571fca5b cve-icon cve-icon
https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.4 cve-icon cve-icon
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-93j4-rcp9-9jx6 cve-icon cve-icon cve-icon
https://www.vulncheck.com/advisories/zoneminder-before-1.38.4-buffer-overflow-via-http-camera-response cve-icon cve-icon
History

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Description ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.
Title ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response
First Time appeared Zoneminder
Zoneminder zoneminder
Weaknesses CWE-120
CPEs cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*
Vendors & Products Zoneminder
Zoneminder zoneminder
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H'}

cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-09-28T22:00:19.143Z

Updated: 2026-10-06T13:36:53.153Z

Reserved: 2026-09-28T21:24:39.616Z

Link: CVE-2026-102296

cve-icon Vulnrichment

Updated: 2026-09-29T19:44:36.205Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-28T22:17:32.233

Modified: 2026-09-30T17:23:08.953

Link: CVE-2026-102296

cve-icon Redhat

No data.