Drupal Gammu SMS Daemon EUVD-2026-70012

Exploitation requires that the attacker hold a high-privilege (administrator-level) role on the target Drupal installation - unauthenticated or low-privilege users cannot trigger this vulnerability based on the PR:H CVSS metric. Beyond authentication, high attack complexity (AC:H) implies additional specific conditions must be met, such as a particular module configuration, modem device attachment state, or precise timing; the exact preconditions are not enumerated in the available description. The vulnerability is limited to Drupal sites that have the Gammu SMS Daemon contributed module installed and enabled. Sites that have never installed this module are not affected.

The vendor-assigned CVSS 3.1 score of 5.9 (Medium) is anchored by PR:H and AC:H, which together substantially reduce exploitability. Exploitation requires an attacker who has already obtained high-privilege (administrator-level) access to the Drupal site and can meet complex attack conditions - meaning this vulnerability cannot be abused by a standard unauthenticated internet attacker. EPSS data is not present in the input, so exploitation probability cannot be quantified. No KEV listing and no POC code are identified, indicating no confirmed or public exploitation at time of analysis. The C:H/I:H outcome is notable in theory (memory disclosure and corruption), but the high privilege bar means the realistic threat is from a compromised or malicious administrator rather than an external adversary. The absence of a specific patched version in the data leaves patch-state uncertain. Overall, this is a low real-world priority for most organizations - highest concern in environments where Drupal admin roles are shared or delegated to untrusted parties.

An attacker who has obtained Drupal administrator credentials - through credential stuffing, phishing, or lateral movement - navigates to a privileged administration page or configuration endpoint served by the Gammu SMS Daemon module and supplies crafted input that triggers an out-of-bounds memory operation. Under favorable conditions (AC:H), the overflow enables the attacker to read sensitive memory contents or overwrite memory to influence program behavior, escalating their foothold. No public POC code is available at time of analysis.