CVE-2026-57486: pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNodecompare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocumentcreateAttribute legitimately leave those fields NULL. When ixmlElementremoveAttributeNode compares two distinct attribute objects with the same nodeName through findconditionnode, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pupnpto a version that resolves this vulnerability.Fixed in 2.0.2
Event History
Frequently Asked Questions
Which deployments are exposed to this crash?
Applications using pupnp before 2.0.2 are affected if attacker-controlled XML can reach ixmlElement_removeAttributeNode in a way that compares distinct non-namespaced attribute objects with the same nodeName.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network access, low attack complexity, no privileges, and no user interaction are required, provided the application processes attacker-controlled XML through the vulnerable path.
What is the impact of successful exploitation?
Successful exploitation causes a NULL pointer dereference and can crash the affected process. The provided impact vector indicates availability impact only, with no confidentiality or integrity impact.
How can this be remediated?
Upgrade pupnp to version 2.0.2, which fixes the issue.