CVE-2026-102296: ZoneMinder Buffer Overflow Vulnerability

CVE-2026-102296 Overview

ZoneMinder versions prior to 1.38.4 contain static buffer overflow vulnerabilities in the RemoteCameraHttp::GetResponse() function. The flaw resides in src/zm_remote_camera_http.cpp and stems from unchecked string copies when parsing HTTP responses from remote cameras. A malicious HTTP camera, or a network attacker able to intercept traffic between ZoneMinder and a legitimate camera, can send crafted response headers to overflow fixed-size stack buffers. Successful exploitation corrupts parser state, crashes the capture process, or corrupts memory in the ZoneMinder service. The vulnerability is tracked as CWE-120: Buffer Copy without Checking Size of Input.

Critical Impact
Attackers who control or intercept HTTP camera traffic can crash the ZoneMinder capture process or corrupt memory by sending oversized status messages, Connection headers, Content-Type values, or multipart boundaries.

Affected Products

ZoneMinder versions prior to 1.38.4
src/zm_remote_camera_http.cpp HTTP camera parser component
Deployments using HTTP-based remote cameras (RemoteCameraHttp)

Discovery Timeline

2026-09-28 - CVE-2026-102296 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102296

Vulnerability Analysis

The vulnerability lives in RemoteCameraHttp::GetResponse(), which parses HTTP responses received from network cameras. The function uses strncpy with lengths derived from response content and strcpy with attacker-controlled data. When the incoming header exceeds the size of the destination stack buffer, memory beyond the buffer is overwritten. The attacker controls the response contents, so oversized values in the status line, Connection header, Content-Type header, or multipart boundary trigger the overflow. Impact ranges from a denial of service on the capture daemon to memory corruption that may disrupt the parser state machine.

Root Cause

The unpatched code relies on strncpy(dst, src, end-start) and strcpy(dst, src) without validating that the copy length fits within sizeof(dst). Because the length is derived from parsed HTTP tokens, an attacker can make it arbitrarily large. The fix introduces zm_strncpy, a bounded copy helper that receives sizeof(dst) as an explicit argument and enforces the destination limit.

Attack Vector

Exploitation requires the attacker to sit on the network path between the ZoneMinder server and a monitored HTTP camera, or to operate a malicious camera that ZoneMinder is configured to poll. When ZoneMinder issues an HTTP request, the attacker returns a crafted response with oversized header fields. The following patch from the vendor illustrates the vulnerable copies and their replacement with bounded operations.

cpp

           start_ptr = http_header;
           end_ptr = start_ptr+strspn(start_ptr, "10.");
 
-          // FIXME Why are we memsetting every time?  Can we not do it once?
-          //memset(http_version, 0, sizeof(http_version));
-          strncpy(http_version, start_ptr, end_ptr-start_ptr);
+          zm_strncpy(http_version, start_ptr, sizeof(http_version), end_ptr-start_ptr);
 
           start_ptr = end_ptr;
           start_ptr += strspn(start_ptr, " ");
           end_ptr = start_ptr+strspn(start_ptr, "0123456789");
 
-          memset(status_code, 0, sizeof(status_code));
-          strncpy(status_code, start_ptr, end_ptr-start_ptr);
+          zm_strncpy(status_code, start_ptr, sizeof(status_code), end_ptr-start_ptr);
           int status = atoi(status_code);
 
           start_ptr = end_ptr;
           start_ptr += strspn(start_ptr, " ");
-          strcpy(status_mesg, start_ptr);
+          zm_strncpy(status_mesg, start_ptr, sizeof(status_mesg));

Source: ZoneMinder Commit 2596e5f

Detection Methods for CVE-2026-102296

Indicators of Compromise

Unexpected crashes or restarts of the ZoneMinder zmc capture process associated with an HTTP camera monitor.
Core dumps referencing RemoteCameraHttp::GetResponse or nearby symbols in zm_remote_camera_http.cpp.
HTTP responses from cameras containing status lines, Connection, Content-Type, or multipart boundary fields larger than a few hundred bytes.

Detection Strategies

Inspect network traffic between the ZoneMinder host and cameras for HTTP response headers that exceed normal RFC 7230 field sizes.
Alert on ZoneMinder service restarts correlated with camera monitor errors in zm_daemon.log.
Use IDS signatures to flag oversized HTTP status-line tokens or malformed multipart boundaries on camera VLANs.

Monitoring Recommendations

Log and baseline HTTP response sizes from each registered camera; investigate deviations.
Monitor process supervision events for zmc termination signals such as SIGSEGV or SIGABRT.
Enable ARP and DHCP monitoring on camera network segments to detect man-in-the-middle staging.

How to Mitigate CVE-2026-102296

Immediate Actions Required

Upgrade ZoneMinder to release 1.38.4 or later, which contains the bounded-copy fix.
Isolate HTTP cameras on a dedicated VLAN with no route to untrusted networks.
Restrict which hosts can serve as camera endpoints in ZoneMinder configuration.

Patch Information

The fix is delivered in commits 2596e5f and 813bf6f, which replace strncpy/strcpy usage in RemoteCameraHttp::GetResponse() with the bounded zm_strncpy helper. Full details are published in GitHub Security Advisory GHSA-93j4-rcp9-9jx6 and the VulnCheck Advisory.

Workarounds

Replace HTTP camera monitors with RTSP or FFmpeg-based monitors where feasible until patching is complete.
Enforce TLS with certificate pinning between ZoneMinder and cameras to defeat interception on the network path.
Apply strict egress and ingress ACLs so only known camera IPs can respond to ZoneMinder HTTP polls.

bash

# Example iptables rules restricting inbound HTTP responses to known cameras
iptables -A INPUT -p tcp --sport 80 -s 10.10.20.11 -d 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --sport 80 -s 10.10.20.12 -d 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --sport 80 -d 10.10.20.5 -j DROP