EUVD-2026-92396
GHSA-2835-94vr-22j6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low privileges (PR:L)
-
ExploitSubmit binary item containing NULL byte
-
ExecutionTrigger out-of-bounds write in processing
-
ImpactCrash Zabbix Server/Proxy (availability loss)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires three concrete prerequisites all drawn from the description and CVSS vector: (1) the Zabbix deployment MUST use MySQL or MariaDB as its backend database - PostgreSQL and other backends are explicitly unaffected; (2) low-privileged authenticated access (PR:L) sufficient to submit binary items to the Server/Proxy; and (3) a crafted binary item value containing a NULL byte (AT:P, the specific input condition). Limiting factors that reduce real-world risk: the impact is confined to availability (a crash/DoS with no data exposure or code execution confirmed), authentication is required so it is not remotely anonymous, and the MySQL/MariaDB-only scope excludes a large portion of installations. |
| Impact | This is a low-priority availability issue, not a genuine emergency. The vendor-assigned CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L) scores only 2.3, and every signal agrees it is low-impact: the sole consequence is a crash (VA:L, availability-only; VC/VI = N), exploitation requires existing privileges (PR:L, authenticated), and an attack requirement is present (AT:P) reflecting the specific NULL-byte input and database-backend precondition. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS score was supplied - so no evidence of active or imminent exploitation. The one caveat is scope: the flaw ONLY manifests on deployments using MySQL/MariaDB as the Zabbix database, so PostgreSQL-backed installations are not affected; defenders must confirm their backend before prioritizing. Note also the mismatch between the metadata tags ('Buffer Overflow', 'Memory Corruption') and the actual rated impact - despite CWE-787 (out-of-bounds write), the realized outcome is only a crash/DoS with no confidentiality or integrity impact, so this should be triaged as a stability bug rather than a code-execution risk. |
| Exploit ScenarioDerived | An authenticated user (or a compromised agent/proxy able to submit data) with permission to send binary items transmits a crafted value containing a NULL byte to a Zabbix Server or Proxy backed by MySQL/MariaDB. The malformed input triggers an out-of-bounds write during processing, crashing the Server/Proxy and interrupting monitoring until the service restarts. No public exploit code has been identified, and exploitation requires low-level privileges (PR:L) plus the specific MySQL/MariaDB backend. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Zabbix Server and Proxy can be crashed by a crafted binary item value containing a NULL byte, causing loss of monitoring availability on deployments that use MySQL or MariaDB as the Zabbix backend database. Exploitation is not anonymous: the CVSS vector (PR:L) indicates an authenticated, low-privileged user able to submit binary item values is required, and the attack additionally depends on a specific input condition (AT:P), which is why the vendor-assigned severity is low (CVSS 4.0 base 2.3) and our independent assessment matches at CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); impact is confined to availability, with no confirmed data exposure, integrity loss, or code execution.
RemediationAI
No vendor-released patch version is identified in the available data; the primary action is to review the Zabbix advisory ZBX-28194 at https://support.zabbix.com/browse/ZBX-28194 to obtain the exact fixed Server and Proxy release and upgrade both components together, since leaving a patched Server talking to an unpatched Proxy (or vice versa) leaves the vulnerable ingest path reachable. Where immediate upgrade is not possible, the highest-value compensating control is to reduce the authenticated surface the flaw requires: use Zabbix user roles and host permissions to ensure that only trusted administrators - not general low-privileged users - can create or modify items on monitored hosts, which directly removes the PR:L precondition but requires an audit of existing roles and may disrupt workflows for operators who currently create items. A second option is migrating the backend database from MySQL/MariaDB to a supported alternative such as PostgreSQL, the configuration explicitly documented as unaffected; this fully closes the issue but is a nontrivial migration project with its own downtime and compatibility risks. As a monitoring measure, enable alerting on unexpected Zabbix Server/Proxy process restarts so crash attempts are detected promptly; note that disabling binary items outright would remove legitimate functionality and is generally not acceptable as a standing mitigation. There is no public exploit code and no KEV listing, so remediation can be scheduled through normal change management rather than emergency response - this is a low-priority availability issue, not a genuine emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified under CWE-787 (out-of-bounds write) and concerns Zabbix 'binary items' - item types that carry raw byte blobs (rather than text or numeric values) from agents or trappers into the Zabbix Server/Proxy ingest path. The deployment scope is the key technical constraint: only MySQL/MariaDB-backed installations are affected, which points at the interaction between binary payload handling and MySQL/MariaDB's NULL-byte semantics when binary data passes through database-layer string/BLOB handling, producing a length or bounds miscalculation that lets the Server/Proxy process write beyond an intended buffer and terminate. The provided CPE (cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*) is a wildcard with no version range supplied, so exact affected releases must be taken from the Zabbix security advisory (ZBX-28194) rather than inferred here. Note the divergence between the root-cause class (CWE-787, a memory-safety write) and the assessed outcome: our assessment confirms only availability impact (A:L, no confidentiality or integrity impact), so the practical effect observed is a crash/denial of service rather than demonstrable exploitation of the out-of-bounds write for code execution.
Know when Zabbix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Authenticated submission of binary items (PR:L), MySQL/MariaDB backend plus crafted NULL-byte input raise complexity (AC:H), and the only effect is a partial availability loss (A:L).
Primary rating from Vendor (Zabbix).
CVSS VectorVendor: Zabbix
DescriptionCVE.org
The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability. This only affects deployments where MySQL/MariaDB database is used as the Zabbix database.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQ
An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. Rated hi
The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x bef
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addre
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. Rated critical severity
Zabbix server can perform command execution for configured scripts. Rated high severity (CVSS 8.8), this vulnerability i
SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, a
Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execu
Stored Cross-Site Scripting (XSS) in Zabbix 7.0.x and 7.4.x allows authenticated administrators with non-super privilege
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resul
Exploit-DB