CVE-2016-8863

Critical

Published: 07/03/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2016-8863 describes a heap-based buffer overflow in the create_url_list function in Portable UPnP SDK before version 1.6.21. This vulnerability allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code by sending a valid URI followed by an invalid one in the CALLBACK header of a SUBSCRIBE request.

Risk Assessment

Organizations may be exposed to remote attacks that could lead to system crashes or unauthorized code execution, potentially resulting in data loss or service interruptions.

Recommendation

It is recommended to update Portable UPnP SDK to version 1.6.21 or later to mitigate this vulnerability. Additionally, monitoring and restricting access to UPnP services on the network is advisable.

Original NVD description (English source)

Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.