{"id":"CVE-2026-93403","aliases":["DEBIAN-CVE-2026-93403","UBUNTU-CVE-2026-93403"],"status":"published","description":"[Stack-based Buffer Overflow in mmpstrucdata rsyslog plugin]","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-23T00:00:00Z","modified":"2026-09-24T02:03:12Z","fixes":[{"ecosystem":"Debian:13","package":"rsyslog","fixed_in":["8.2504.0-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rsyslog","fixed_in":["8.2606.0-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"rsyslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.2302.0-1","8.2302.0-1+deb12u1","8.2304.0-1","8.2306.0-1","8.2306.0-2","8.2308.0-1","8.2310.0-1","8.2310.0-2","8.2310.0-3","8.2310.0-4","8.2312.0-1","8.2312.0-2","8.2312.0-3","8.2402.0-1","8.2404.0-1","8.2404.0-2","8.2406.0-1","8.2408.0-1","8.2408.0-2","8.2410.0-1","8.2412.0-1","8.2412.0-2","8.2502.0-1","8.2502.0-2","8.2502.0-3","8.2502.0-4","8.2502.0-5","8.2502.0-6","8.2504.0-1","8.2506.0-1","8.2506.0-2","8.2506.0-3","8.2506.0-4","8.2506.0-6","8.2510.0-1","8.2510.0-2","8.2510.0-3","8.2510.0-4","8.2510.0-5","8.2512.0-1","8.2512.0-2","8.2512.0-3","8.2602.0-1","8.2604.0-1","8.2604.0-2","8.2604.0-3","8.2604.0-4","8.2606.0-1","8.2606.0-2","8.2606.0-3","8.2606.0-4","8.2608.0-1","8.2608.0-2","8.2608.0-3","8.2608.0-4"]},{"source":"osv","ecosystem":"Debian:13","package":"rsyslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2504.0-1+deb13u2"}]}],"versions":["8.2504.0-1","8.2504.0-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"rsyslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2606.0-4"}]}],"versions":["8.2504.0-1","8.2506.0-1","8.2506.0-2","8.2506.0-3","8.2506.0-4","8.2506.0-6","8.2510.0-1","8.2510.0-2","8.2510.0-3","8.2510.0-4","8.2510.0-5","8.2512.0-1","8.2512.0-2","8.2512.0-3","8.2602.0-1","8.2604.0-1","8.2604.0-2","8.2604.0-3","8.2604.0-4","8.2606.0-1","8.2606.0-2","8.2606.0-3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"rsyslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.11-2ubuntu4","7.4.4-1ubuntu1","7.4.4-1ubuntu2","7.4.4-1ubuntu2.1","7.4.4-1ubuntu2.3","7.4.4-1ubuntu2.5","7.4.4-1ubuntu2.6","7.4.4-1ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsyslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.12.0-1ubuntu2","8.12.0-1ubuntu3","8.14.0-2ubuntu1","8.14.0-2ubuntu2","8.16.0-1ubuntu1","8.16.0-1ubuntu2","8.16.0-1ubuntu3","8.16.0-1ubuntu3.1","8.16.0-1ubuntu3.1+esm1","8.16.0-1ubuntu3.1+esm2","8.16.0-1ubuntu3.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsyslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.16.0-1ubuntu9","8.16.0-1ubuntu10","8.32.0-1ubuntu3","8.32.0-1ubuntu4","8.32.0-1ubuntu4.2","8.32.0-1ubuntu4.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsyslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.1901.0-1ubuntu4","8.2001.0-1ubuntu1","8.2001.0-1ubuntu1.1","8.2001.0-1ubuntu1.3","8.2001.0-1ubuntu1.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsyslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.2102.0-2ubuntu2","8.2110.0-3ubuntu1","8.2110.0-3ubuntu2","8.2110.0-4ubuntu1","8.2112.0-2ubuntu2","8.2112.0-2ubuntu2.2","8.2112.0-2ubuntu2.4","8.2112.0-2ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rsyslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.2306.0-2ubuntu2","8.2312.0-3ubuntu1","8.2312.0-3ubuntu2","8.2312.0-3ubuntu3","8.2312.0-3ubuntu7","8.2312.0-3ubuntu8","8.2312.0-3ubuntu9","8.2312.0-3ubuntu9.1","8.2312.0-3ubuntu9.2","8.2312.0-3ubuntu9.3","8.2312.0-3ubuntu9.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rsyslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.2504.0-1ubuntu2","8.2512.0-1ubuntu2","8.2512.0-1ubuntu3","8.2512.0-1ubuntu4","8.2512.0-1ubuntu4.1","8.2512.0-1ubuntu4.2"]}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2026-93403","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-93403","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93403","tags":["report"]},{"url":"https://github.com/rsyslog/rsyslog/security/advisories/GHSA-2whq-6rcm-64m8","tags":["report"]},{"url":"https://github.com/rsyslog/rsyslog/pull/6991","tags":["report"]}],"sources":{"osv":[{"id":"DEBIAN-CVE-2026-93403","status":"published","published":"2026-09-23T16:47:41.210266458Z","modified":"2026-09-23T17:00:09.161011044Z","updated_at":"2026-11-02T15:46:06.846102Z"},{"id":"UBUNTU-CVE-2026-93403","description":"[Stack-based Buffer Overflow in mmpstrucdata rsyslog plugin]","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-09-24T02:03:12.009752532Z","updated_at":"2026-11-02T16:57:44.071534Z"}]}}