CVE-2026-102296: ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZoneMinderto a version that resolves this vulnerability.Fixed in 1.38.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that ingest HTTP camera responses are exposed when a camera can return maliciously oversized HTTP headers or when an attacker can intercept and alter those responses in transit.
What does an attacker need to exploit the vulnerability?
The attacker must be able to control an HTTP camera's response or modify the response between the camera and ZoneMinder. The supplied CVSS vector indicates no privileges or user interaction are required, but exploitation has high attack complexity.
What are the likely effects of successful exploitation?
Crafted oversized status messages, Connection headers, Content-Type values, or multipart boundaries can corrupt parser state. This can crash the capture process or cause memory corruption, with high availability impact and low integrity impact in the supplied severity data.