CVE-2026-93403

No scoreFix available

[Stack-based Buffer Overflow in mmpstrucdata rsyslog plugin]

What each source reports

OSVUBUNTU-CVE-2026-93403 No score

[Stack-based Buffer Overflow in mmpstrucdata rsyslog plugin]

Record: UBUNTU-CVE-2026-93403
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`rsyslog` Debian:12	All versions, plus listed versions 8.2302.0-18.2302.0-1+deb12u18.2304.0-18.2306.0-18.2306.0-2 Show 45 moreShow less 8.2308.0-18.2310.0-18.2310.0-28.2310.0-38.2310.0-48.2312.0-18.2312.0-28.2312.0-38.2402.0-18.2404.0-18.2404.0-28.2406.0-18.2408.0-18.2408.0-28.2410.0-18.2412.0-18.2412.0-28.2502.0-18.2502.0-28.2502.0-38.2502.0-48.2502.0-58.2502.0-68.2504.0-18.2506.0-18.2506.0-28.2506.0-38.2506.0-48.2506.0-68.2510.0-18.2510.0-28.2510.0-38.2510.0-48.2510.0-58.2512.0-18.2512.0-28.2512.0-38.2602.0-18.2604.0-18.2604.0-28.2604.0-38.2604.0-48.2606.0-18.2606.0-28.2606.0-3	None known
`rsyslog` Debian:13	before 8.2504.0-1+deb13u2, plus listed versions 8.2504.0-18.2504.0-1+deb13u1	8.2504.0-1+deb13u2
`rsyslog` Debian:14	before 8.2606.0-4, plus listed versions 8.2504.0-18.2506.0-18.2506.0-28.2506.0-38.2506.0-4 Show 17 moreShow less 8.2506.0-68.2510.0-18.2510.0-28.2510.0-38.2510.0-48.2510.0-58.2512.0-18.2512.0-28.2512.0-38.2602.0-18.2604.0-18.2604.0-28.2604.0-38.2604.0-48.2606.0-18.2606.0-28.2606.0-3	8.2606.0-4
`rsyslog` Ubuntu:14.04:LTS	All versions, plus listed versions 5.8.11-2ubuntu47.4.4-1ubuntu17.4.4-1ubuntu27.4.4-1ubuntu2.17.4.4-1ubuntu2.37.4.4-1ubuntu2.57.4.4-1ubuntu2.67.4.4-1ubuntu2.7	None known
`rsyslog` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 8.12.0-1ubuntu28.12.0-1ubuntu38.14.0-2ubuntu18.14.0-2ubuntu28.16.0-1ubuntu1 Show 6 moreShow less 8.16.0-1ubuntu28.16.0-1ubuntu38.16.0-1ubuntu3.18.16.0-1ubuntu3.1+esm18.16.0-1ubuntu3.1+esm28.16.0-1ubuntu3.1+esm3	None known
`rsyslog` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 8.16.0-1ubuntu98.16.0-1ubuntu108.32.0-1ubuntu38.32.0-1ubuntu48.32.0-1ubuntu4.28.32.0-1ubuntu4.2+esm1	None known
`rsyslog` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 8.1901.0-1ubuntu48.2001.0-1ubuntu18.2001.0-1ubuntu1.18.2001.0-1ubuntu1.38.2001.0-1ubuntu1.3+esm1	None known
`rsyslog` Ubuntu:22.04:LTS	All versions, plus listed versions 8.2102.0-2ubuntu28.2110.0-3ubuntu18.2110.0-3ubuntu28.2110.0-4ubuntu18.2112.0-2ubuntu28.2112.0-2ubuntu2.28.2112.0-2ubuntu2.48.2112.0-2ubuntu2.5	None known
`rsyslog` Ubuntu:24.04:LTS	All versions, plus listed versions 8.2306.0-2ubuntu28.2312.0-3ubuntu18.2312.0-3ubuntu28.2312.0-3ubuntu38.2312.0-3ubuntu7 Show 6 moreShow less 8.2312.0-3ubuntu88.2312.0-3ubuntu98.2312.0-3ubuntu9.18.2312.0-3ubuntu9.28.2312.0-3ubuntu9.38.2312.0-3ubuntu9.4	None known
`rsyslog` Ubuntu:26.04:LTS	All versions, plus listed versions 8.2504.0-1ubuntu28.2512.0-1ubuntu28.2512.0-1ubuntu38.2512.0-1ubuntu48.2512.0-1ubuntu4.18.2512.0-1ubuntu4.2	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-93403 is a vulnerability with no CVSS score yet in rsyslog, published September 23, 2026. No source lists public exploit code. Fixed in rsyslog 8.2504.0-1+deb13u2.

References

This page doesn't list everything

Left out here: 5 versions. The JSON record has them.