CVE-2026-102296

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.38.4

Description A static buffer overflow exists in the RemoteCameraHttp::GetResponse() function. This issue allows malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversized response headers. Specifically, attackers can send crafted HTTP responses containing oversized status messages, Connection headers, Content-Type values, or multipart boundaries to corrupt the parser state, leading to memory corruption or a crash of the capture process.

Recommendations Update to version 1.38.4 or later.