CVE-2026-76757: Gammu SMS Daemon Buffer Overflow Flaw

CVE-2026-76757 Overview

CVE-2026-76757 is a memory corruption vulnerability affecting the Drupal Gammu SMS Daemon contributed module. The flaw is categorized under [CWE-119], improper restriction of operations within the bounds of a memory buffer. An authenticated attacker with high privileges can exploit the issue over the network to compromise the confidentiality and integrity of the affected system.

Critical Impact
Successful exploitation allows an attacker with high privileges to read sensitive data and modify records processed by the Gammu SMS Daemon module, undermining the trust boundary between the Drupal application and the SMS gateway integration.

Affected Products

Drupal Gammu SMS Daemon contributed module

Discovery Timeline

2026-09-02 - CVE-2026-76757 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-76757

Vulnerability Analysis

The Drupal Gammu SMS Daemon module bridges Drupal with the Gammu SMS gateway to send and receive short messages. The vulnerability arises from improper handling of buffer boundaries when the module processes attacker-influenced input. An authenticated user with elevated privileges can trigger operations that read or write outside the intended memory region.

Exploitation requires network access to the Drupal site and high privileges within the application. The attack complexity is high because the attacker must satisfy specific conditions to reach the vulnerable code path. Successful exploitation yields high impact to confidentiality and integrity, without affecting availability.

Root Cause

The root cause is a memory buffer boundary violation classified under [CWE-119]. The module fails to properly restrict operations on a memory buffer, allowing input processed through the Gammu SMS Daemon integration to overrun expected limits. Consult the Drupal Security Advisory for the specific code paths involved.

Attack Vector

The attack vector is network-based. An authenticated attacker holding a privileged Drupal role sends crafted requests that reach the Gammu SMS Daemon integration logic. Because user interaction is not required and the scope is unchanged, the attacker acts directly against the vulnerable component to disclose or manipulate data.

No public proof-of-concept exploit or exploitation in the wild has been reported. Refer to the Drupal Security Advisory for technical specifics.

Detection Methods for CVE-2026-76757

Indicators of Compromise

Unexpected modifications to SMS records, queues, or delivery status entries maintained by the Gammu SMS Daemon module.
Anomalous requests from privileged Drupal accounts to endpoints associated with the Gammu SMS Daemon module.
PHP error log entries referencing memory faults, segmentation issues, or aborted requests originating from the module.

Detection Strategies

Monitor Drupal watchdog and web server logs for repeated privileged requests targeting Gammu SMS Daemon routes with unusually large or malformed payloads.
Correlate authenticated administrative sessions with abnormal database writes to SMS-related tables.
Baseline normal SMS traffic patterns and alert on deviations that could indicate exploitation of the module.

Monitoring Recommendations

Enable verbose logging on the Drupal site and forward events to a centralized analytics platform for correlation.
Track privileged role assignments and audit any accounts capable of interacting with the Gammu SMS Daemon module.
Alert on process crashes or PHP-FPM worker restarts coinciding with requests to module endpoints.

How to Mitigate CVE-2026-76757

Immediate Actions Required

Review the Drupal Security Advisory and apply the fixed release of the Gammu SMS Daemon module as soon as it is available.
Inventory Drupal sites that have the Gammu SMS Daemon module enabled and prioritize remediation on internet-facing deployments.
Audit privileged user accounts and revoke unnecessary administrative permissions that could reach the vulnerable code path.

Patch Information

The vendor has published guidance in the Drupal Security Advisory. Update the Gammu SMS Daemon contributed module to the version identified in that advisory. Confirm the module version after upgrade using drush pm:list --type=module | grep gammu.

Workarounds

Disable the Gammu SMS Daemon module on affected Drupal sites until the patched version is installed.
Restrict access to administrative interfaces using network controls or a web application firewall to limit exposure to authenticated attackers.
Enforce least privilege by removing high-privilege roles from accounts that do not require SMS gateway administration.

bash

# Temporarily disable the Gammu SMS Daemon module using Drush
drush pm:uninstall gammu_sms_daemon
drush cache:rebuild