EUVD-2026-101128
GHSA-r8vm-xv99-82gx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network foothold
-
DeliverySpoof/host rogue UPnP gateway
-
ExploitVictim performs UPnP discovery
-
ExecutionServe crafted XML ending in '='
-
PersistTrigger OOB read in parseatt
-
ImpactCrash miniupnpc client (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an attacker on the victim's local/adjacent network (AV:A) who controls or spoofs a UPnP Internet Gateway Device, plus the victim application actively performing UPnP discovery and parsing the rogue gateway's device description or SOAP response. The specific trigger (AT:P) is a crafted XML reply in which attribute parsing reaches an '=' character at the very end of the buffer, causing parseatt to read one byte past bounds. Limiting factors: no remote/internet exploitation (adjacent only), high attack complexity, the victim must initiate UPnP, and only client availability is affected - no code execution or data disclosure. |
| Impact | All signals point to a low-priority, low-impact issue. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N/UI:N) scores only 2.3 and the sole impact is VA:L - a client crash - with VC:N and VI:N, meaning no confidentiality or integrity consequence despite the 'Information Disclosure' tag and CWE-125 read classification; the one-byte out-of-bounds read is used to crash the client, not to exfiltrate data. Exploitation requires an adjacent-network position (AV:A), high attack complexity (AC:H), and a present attack requirement (AT:P - the reply must end in '='), all of which further constrain real-world risk. POC code is publicly available (VulnCheck/hackmd write-up), which slightly raises practical exploitability, but there is no CISA KEV listing and no EPSS value was supplied, so there is no evidence of active or widespread exploitation. Net: this is a genuine but minor DoS bug, not a high-risk priority; the 'Information Disclosure' tag overstates impact relative to the vendor-assigned vector (VC:N). |
| Exploit ScenarioDerived | An attacker on the same local network stands up (or spoofs) a rogue UPnP Internet Gateway Device and waits for a victim application using miniupnpc to perform UPnP discovery. When the client fetches the device description or issues a SOAP request, the rogue gateway returns a crafted XML reply whose attribute ends immediately after an '=' character, triggering a one-byte heap out-of-bounds read in parseatt that crashes the client. A public proof-of-concept exists, but the high complexity, adjacent-network requirement, and crash-only impact limit practical damage. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read in the minixml parser's parseatt() routine: a malicious or spoofed UPnP Internet Gateway Device on the local network can return a crafted device description or SOAP response whose attribute list ends with an '=' character, causing the client to read one byte past the end of its buffer and crash. Publicly available exploit code exists (a detailed write-up is linked alongside the upstream fix), but there is no confirmed active exploitation; the flaw is rated CVSS 2.3 (CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N, low availability-only impact), so the realistic outcome is a limited denial of service for unauthenticated attackers who already share the victim's adjacent network and can spoof the gateway. No code execution or data disclosure is associated with this issue.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed. The vendor commit https://github.com/miniupnp/miniupnp/commit/3cfb4fb78d5ac04ed0dadc8dd842fc9e448916db adds a bounds check after the '=' is consumed (if(p->xml >= p->xmlend) return -1;) in minixml.c across miniupnpc, miniupnpc-async, miniupnpc-libevent and miniupnpd; build from that commit or any subsequent tagged release that contains it, and note that 2.3.3 is the last confirmed-vulnerable version, so verify the changelog before assuming a package update resolves the issue. Where patching must wait, the practical compensating controls are to disable UPnP/IGD discovery in the consuming application or drop the bundled minixml usage, with the trade-off that NAT traversal, automatic port mapping and WAN-address discovery stop working; alternatively restrict UPnP discovery to trusted, segmented networks and block SSDP/UPnP traffic from client VLANs to anything other than known gateways, which reduces exposure to spoofed IGDs but does not protect hosts sharing a network with an attacker. Because the trigger is a client-side crash, monitor for abnormal process termination during UPnP discovery and treat unexpected client crashes on untrusted LANs as a signal of gateway spoofing. Advisory and PoC details are available at https://www.vulncheck.com/advisories/miniupnpc-through-2.3.3-heap-out-of-bounds-read-via-minixml-parseatt and https://hackmd.io/@haind-pwn/miniupnpc-minixml-oob-read.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
miniupnpc is the client-side UPnP library used to discover and control UPnP Internet Gateway Devices (IGDs), and it bundles minixml.c, a compact hand-written XML parser shared across several code paths in the miniupnp project (miniupnpc/src, miniupnpc-async, miniupnpc-libevent and miniupnpd, all touched by the same upstream commit). The vulnerability is CWE-125 (Out-of-bounds Read) in the static parseatt() function: after consuming an attribute name, the parser advances its cursor (p->xml) past the '=' separator and then dereferences the next character without first verifying that the cursor has not reached the end-of-buffer marker (p->xmlend). When a gateway-supplied document terminates with '=', that dereference reads one byte beyond the allocated heap buffer - a single-byte over-read that is normally non-fatal to memory safety but can crash the parsing client depending on allocator behavior. Exploitation requires control of the XML delivered to the client, which is why the assessed vector is limited to adjacent network (AV:A), high complexity (AC:H), unauthenticated (PR:N), with only low availability impact (VA:L) and no confidentiality or integrity effect. The CPE record cpe:2.3:a:miniupnp_project:miniupnpc:*:*:*:*:*:*:*:* wildcards the version field, but the vendor advisory scopes the issue to releases through 2.3.3; the same minixml.c code is mirrored in miniupnpd and the async/libevent client variants, so those copies carry the identical defect.
Know when Miniupnpc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Adjacent attacker must host a rogue gateway and win a precise buffer-boundary condition (AV:A, AC:H); no auth needed (PR:N); impact is a client crash only (A:L, C/I:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.201509
A one-byte heap out-of-bounds read in miniupnpc through 2.3.3 lets an attacker on the same local network crash a UPnP cl
Exploit-DB