CVE-2026-110656: miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Clients using Miniupnpc through 2.3.3 that communicate with a malicious or spoofed UPnP gateway on the local network are exposed. The attack is adjacent-network scoped rather than remotely reachable over the Internet according to the provided vector.
What does an attacker need to exploit this issue?
The attacker needs to control or spoof a local UPnP gateway and provide a device description or SOAP response with an element name ending in ':'. No privileges or user interaction are required, but exploitation has high attack complexity.
What is the expected security impact?
The stated impact is a client crash from a one-byte heap out-of-bounds read. The supplied scoring data indicates no confidentiality or integrity impact and low availability impact.