EUVD-2026-88562
GHSA-9748-j7v2-wg49
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because the attacker must control or MITM the camera side of the connection; PR:N/UI:N as ZoneMinder needs no auth; A:H for reliable capture-process crash, I:L for memory corruption, C:N as no data is disclosed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.
AnalysisAI
A static buffer overflow in ZoneMinder's Remote HTTP camera response parser (RemoteCameraHttp::GetResponse()) affects all versions before 1.38.4 and lets a malicious or compromised HTTP camera - or an on-path attacker able to modify the camera's traffic - corrupt fixed-size buffers by sending oversized HTTP status messages, Connection headers, Content-Type values, or multipart boundaries. Successful abuse corrupts parser state and can crash the capture process or corrupt memory; integrity impact is limited (VI:L) while availability impact is high (VA:H), and no public exploit has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a ZoneMinder monitor be configured to capture from a Remote HTTP-source camera (RemoteCameraHttp path), and that the attacker either operates/compromises that camera or can intercept and modify its HTTP responses (on-path/MITM). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditionally-triggered memory-safety flaw, not a high-CVSS paper tiger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to ZoneMinder 1.38.4, which contains the bounded zm_strncpy() replacement; the relevant fixes are commits 2596e5fb64c0348e615577b0ab08dc38b6dc6ed8 and 813bf6f1a3ffc92c163352f2480477ba571fca5b, and the release is at https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.4 (advisory: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-93j4-rcp9-9jx6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ZoneMinder installations and identify any running versions before 1.38.4, then immediately apply the patch (Vendor-released patch: 1.38.4) to externally exposed or business-critical surveillance servers; if patching cannot be completed immediately, restrict remote HTTP camera sources to trusted camera VLANs and monitor capture processes for crashes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Zoneminder
View allincludes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitra
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and An
ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Rated critical severity (CVSS 9.8), this
Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled wi
Command injection in ZoneMinder v1.36.34 video surveillance system via web/views/image.php. Unsanitized user input enabl
SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via
ZoneMinder is a free, open source closed-circuit television software application. Rated critical severity (CVSS 9.8), th
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and An
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter. Rated critica
ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated b
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters. R
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today