CVE-2026-110656
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.
Risk Assessment
An attacker on the local network can remotely crash an application using miniupnpc, causing a denial of service. The risk affects systems using UPnP to communicate with network gateways.
Recommendation
Update miniupnpc to a version newer than 2.3.3 once a fix is available. Limit trust in UPnP responses originating from the local network.
Other vulnerabilities in miniupnpc
Original NVD description (English source)
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS