CVE-2026-110655: miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker on the local network who can spoof a UPnP gateway or otherwise serve malicious UPnP device-description or SOAP replies can target Miniupnpc clients.
What input is required to trigger the crash?
The malicious UPnP reply must contain crafted content ending in an equals sign ('='), which causes the minixml parseatt function to read one byte past a heap buffer boundary.
What is the known impact?
The reported impact is a client crash caused by a one-byte heap out-of-bounds read. The provided data does not indicate confidentiality or integrity impact.
Which versions should be investigated?
Miniupnpc versions through 2.3.3 are identified as affected. Review deployments that use Miniupnpc and communicate with UPnP gateways on potentially untrusted local networks.