CVE-2026-102296 ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response
Attackers can cause memory corruption or crashes in ZoneMinder by sending oversized HTTP responses from malicious cameras or via interception.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102296?
CVE-2026-102296 is a high-severity memory corruption vulnerability in zoneminder, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.
Weakness: CWE-120
Which versions are affected by CVE-2026-102296?
How do I fix CVE-2026-102296?
No fix has been published for CVE-2026-102296 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-102296 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102296 exists.
Sources
Also known as DEBIAN-CVE-2026-102296, GHSA-93j4-rcp9-9jx6, GHSA-9748-j7v2-wg49, UBUNTU-CVE-2026-102296.