CVE-2026-110655
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
Risk Assessment
An attacker on the local network can remotely crash an application using miniupnpc, causing a denial of service. The risk affects systems using UPnP to communicate with network gateways.
Recommendation
Update miniupnpc to a version newer than 2.3.3 once a fix is available. Limit trust in UPnP responses originating from the local network.
Other vulnerabilities in miniupnpc
Original NVD description (English source)
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS