CVE-2026-76755: Drupal Gammu SMS Daemon Buffer Overflow

CVE-2026-76755 Overview

CVE-2026-76755 affects the Drupal Gammu SMS Daemon contributed module. The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Drupal published advisory SA-CONTRIB-2026-100 describing the issue.

The flaw is exploitable over the network but requires high privileges and high attack complexity, limiting the pool of viable attackers. Successful exploitation impacts confidentiality and integrity but not availability.

Critical Impact
An authenticated, high-privileged attacker can trigger a memory boundary violation in the Gammu SMS Daemon module, potentially exposing sensitive data and modifying protected information on the Drupal site.

Affected Products

Drupal Gammu SMS Daemon (contributed module)
Refer to Drupal Security Advisory SA-CONTRIB-2026-100 for version details
Drupal sites integrating Gammu-based SMS gateways through this module

Discovery Timeline

2026-09-02 - CVE-2026-76755 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-76755

Vulnerability Analysis

The Drupal Gammu SMS Daemon module bridges Drupal sites with the Gammu SMS Daemon (gammu-smsd) for sending and receiving text messages. CVE-2026-76755 stems from improper restriction of operations within the bounds of a memory buffer, a class of defect tracked as [CWE-119].

An attacker with high privileges on the target Drupal site can supply input that the module processes without sufficient bounds enforcement. The resulting memory boundary violation can leak sensitive data from the process address space and allow modification of adjacent memory regions.

Because the attack complexity is high, exploitation depends on specific runtime conditions such as buffer state, message length, or encoding paths that are not reliably attacker-controlled. Availability is not directly impacted, which suggests the affected code path recovers or short-circuits rather than crashing the worker process.

Root Cause

The root cause is a memory buffer boundary weakness in the module's handling of SMS-related data. The exact function is not disclosed in the public NVD entry. See the Drupal Security Advisory SA-CONTRIB-2026-100 for module-specific technical detail.

Attack Vector

The attack vector is network-based. An authenticated user with elevated privileges within Drupal, such as a role permitted to manage SMS content or module configuration, submits crafted input that reaches the vulnerable buffer-handling routine. No user interaction is required beyond the attacker's own request.

No public proof-of-concept, exploit code, or evidence of exploitation in the wild is available for CVE-2026-76755 at this time. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-76755

Indicators of Compromise

Unexpected changes to SMS-related Drupal configuration, message queues, or delivery logs performed by privileged accounts
Anomalous PHP or gammu-smsd process behavior, including segmentation faults, unusual memory usage, or restart events
Outbound SMS traffic that does not correlate with legitimate workflow activity

Detection Strategies

Monitor Drupal watchdog and web server logs for privileged user activity against Gammu SMS Daemon module endpoints and administrative paths
Inspect PHP-FPM and Apache or Nginx error logs for memory-related warnings originating from the module's namespace
Compare installed contributed module versions against the fixed release referenced in SA-CONTRIB-2026-100

Monitoring Recommendations

Alert on administrative role assignments and permission changes that grant SMS module capabilities
Track database changes to Gammu SMS Daemon configuration tables and cross-reference with authenticated session data
Correlate authenticated Drupal requests with SMS gateway activity to identify suspicious message patterns

How to Mitigate CVE-2026-76755

Immediate Actions Required

Apply the patched Gammu SMS Daemon module release referenced in Drupal Security Advisory SA-CONTRIB-2026-100
Audit Drupal user roles and remove SMS module permissions from accounts that do not require them
Rotate credentials and API keys used by the SMS gateway if compromise is suspected

Patch Information

Drupal has published SA-CONTRIB-2026-100 covering this issue. Site administrators should update the Gammu SMS Daemon contributed module to the fixed version listed in the advisory and run drush updatedb (or the equivalent update path) after deployment.

Workarounds

Disable the Gammu SMS Daemon module until the fixed version can be deployed if SMS functionality is not business-critical
Restrict the permissions that gate access to the module so only trusted administrators can reach the vulnerable code path
Place the Drupal administrative interface behind network controls such as VPN or IP allowlisting to reduce attacker reachability

bash

# Configuration example - update the contributed module using Composer and Drush
composer update drupal/gammu_smsd --with-dependencies
vendor/bin/drush updatedb -y
vendor/bin/drush cache:rebuild

# Optional: temporarily disable the module if patching must be deferred
vendor/bin/drush pm:uninstall gammu_smsd