rsyslog mmpstrucdata CVE-2026-93403

Exploitation requires that the rsyslog mmpstrucdata module be explicitly loaded and applied in a ruleset (module(load="mmpstrucdata")), which is NOT part of a default rsyslog configuration - this is the primary limiting factor. The attacker must be able to submit a syslog message containing crafted RFC5424 structured-data (SD elements/SD-PARAMs) that reaches the mmpstrucdata parse path; reachability therefore also depends on rsyslog being configured to accept messages from the attacker (e.g., remote imudp/imtcp/imrelp network inputs, or a local injection path). Impact scope depends on the privilege level rsyslog runs under (frequently root or a dedicated syslog user). Because CVSS data is absent, authentication requirements are not confirmed from the source; syslog network intake is typically unauthenticated, but this must be verified against the specific deployment.

This is a stack-based buffer overflow (CWE-121, though CWE is unset in the input) in rsyslog's mmpstrucdata message-modification plugin, which parses RFC5424 structured-data fields out of syslog messages. No CVSS score or vector is provided, so attack vector, complexity, and privilege requirements are not vendor-confirmed and my metrics below are an independent inference. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept, so the current evidence is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation. The realistic risk hinges on two facts the input does not resolve: (1) whether the vulnerable message path is reachable over the network (rsyslog commonly ingests remote syslog over UDP/TCP without authentication) and (2) whether mmpstrucdata is actually loaded, since it is an OPTIONAL module not enabled in default rsyslog configurations. Because mmpstrucdata is only active when an operator explicitly configures module(load="mmpstrucdata") and applies it in a ruleset, the population of genuinely exploitable hosts is far smaller than the ubiquitous rsyslog install base. If reachable, a stack overflow in a syslog daemon (often running as root or a dedicated syslog user) is a serious primitive, but modern stack canaries, ASLR, and NX make reliable code execution non-trivial, and the most likely observed outcome is a daemon crash / loss of logging. Net: potentially high impact but gated by a non-default configuration and no confirmed exploitation - treat as a patch-when-available item rather than an emergency, unless mmpstrucdata is known to be in use on internet- or tenant-facing log collectors.

An attacker who can deliver a syslog message to an rsyslog instance that has the mmpstrucdata module loaded sends a message with malformed or oversized RFC5424 structured-data (SD-PARAM) content that overflows a fixed-size stack buffer during parsing. Depending on platform mitigations this either crashes the rsyslog daemon (denial of logging) or is escalated to code execution in the context of the rsyslog process. No public exploit code or active-exploitation evidence is currently identified.