CVE-2026-102296
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.
Risk Assessment
An attacker can crash the capture process or corrupt memory, potentially leading to denial of service or code execution. This requires control over an HTTP camera or interception of traffic.
Recommendation
Update ZoneMinder to version 1.38.4 or later. Consider network segmentation to limit camera access to the system.
Other vulnerabilities in ZoneMinder
See all- CVE-2016-10206High
CVE-2016-10206 is a CSRF vulnerability in Zoneminder 1.30 and earlier that allows remote attackers to hijack user authentication for requests that change passwords and possibly other unspecified impacts.
- CVE-2016-10205High
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.
- CVE-2017-5368High
ZoneMinder versions 1.30 and 1.29 are vulnerable to CSRF attacks, allowing a remote attacker to make changes to the web application as the currently logged-in user. The attacker can silently create a new admin user, enabling further attacks.
- CVE-2016-10204Critical
CVE-2016-10204 is an SQL injection vulnerability in Zoneminder 1.30 and earlier that allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.
- CVE-2026-102297Medium
ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor boundaries.
- CVE-2024-58386Medium
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.
- CVE-2026-54258Medium
ZoneMinder versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI hides the restricted monitor, but direct event media views accept an arbitrary eid and stream media without enforcing event/monitor-level ACL.
- CVE-2026-76060High
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
- CVE-2026-72556High
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. canEdit() and canDelete() call nonexistent methods, causing PHP __call() to return truthy and bypass the check.
- CVE-2023-31493Medium
A Remote Code Execution (RCE) vulnerability in ZoneMinder through version 1.36.33 allows an attacker to create a new .php log file in the language folder. By executing a crafted payload, the attacker can escalate privileges and execute arbitrary commands on the remote system.
Original NVD description (English source)
ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Attackers can send crafted HTTP responses with oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt parser state and crash the capture process or corrupt memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS