Drupal Gammu SMS Daemon EUVD-2026-69988

Exploitation requires: (1) an active Drupal administrator-level account (PR:H) on the target site; (2) the Gammu SMS Daemon contributed module must be installed and enabled; (3) high attack complexity (AC:H) conditions must be met - the exact trigger is not detailed in the available description, but is likely a specific configuration state or crafted input to the SMS gateway interface. Exploitation is limited by the PR:H requirement - unauthenticated or low-privileged users cannot reach the vulnerable code path. Sites that do not have the Gammu SMS Daemon module installed are completely unaffected regardless of Drupal version.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) scores 5.9 (Medium), reflecting a balance between high confidentiality/integrity impact and significant limiting factors: High Attack Complexity (AC:H) and High Privileges Required (PR:H). In practice, exploitation demands an already-privileged Drupal administrator account plus specific conditions to trigger the memory corruption reliably - this substantially narrows the realistic attacker population and opportunity. The A:N metric is unusual for a buffer overflow and may reflect a controlled overread or partial overwrite that does not crash the daemon, though this is inferred rather than confirmed by vendor documentation. No EPSS score, KEV listing, or public exploit code is present in the input data. Real-world risk is further constrained by the niche deployment footprint of this contrib module; sites not using Drupal SMS gateway functionality are entirely unaffected. Overall, this is a medium-priority issue: significant impact if exploited by a compromised admin account, but not an immediate emergency for most environments.

An attacker who has obtained or compromised a Drupal administrator account on a site running the Gammu SMS Daemon module sends a specially crafted request or configures a malicious SMS gateway parameter that triggers a buffer overflow in the module's memory handling. Under the right AC:H conditions, this corrupts process memory in a controlled manner, allowing the attacker to read sensitive application data (C:H) or overwrite memory to alter program behavior (I:H). No public exploit code has been identified at time of analysis.