EUVD-2026-101129
GHSA-mpq5-p36j-xg57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local network position
-
DeliverySpoof/impersonate UPnP gateway
-
ExploitSend crafted XML element name ending in ':'
-
ExecutionSkip end-of-buffer check in parseelt
-
ImpactOne-byte heap OOB read crashes client
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an attacker to be present on the victim's local network and to act as, or spoof, a UPnP gateway device (AV:A). The victim must be running a miniupnpc-based client (<= 2.3.3) that performs UPnP discovery or SOAP interaction and parses the attacker's device description or SOAP reply. The malicious response must contain an XML element name whose namespace-prefix ':' falls at the very end of the buffer, so the parser advances past ':' and reads one byte beyond the heap allocation. Limiting factors: exploitation is bounded to the local/adjacent network (not internet-routable), has high attack complexity plus a present attack requirement (AT:P) implying timing/response-shaping, and the maximum achievable outcome is a client crash - no code execution, no information disclosure, no privilege gain. |
| Impact | This is a genuinely low-priority issue despite being a memory-safety bug. All signals agree: the CVSS 4.0 base score is 2.3 (Low) with AV:A (adjacent/local network only), AC:H (high complexity), and AT:P (a present attack requirement), meaning the attacker must be positioned on the victim's local network and win a race or craft a specific malformed response. The sole impact is VA:L - a one-byte heap out-of-bounds READ (CWE-125) that crashes the client; there is no confidentiality (VC:N) or integrity (VI:N) impact, so this is a denial-of-service only. A public POC exists (hackmd write-up) and a vendor patch is available, but the vulnerability is NOT in CISA KEV and no EPSS score was provided in the input. POC availability does not equal active exploitation. Note a conflict with the input tags: 'Information Disclosure' is contradicted by the CVSS vector (VC:N) and the crash-only nature of the bug, and 'Buffer Overflow' is imprecise for what is actually an out-of-bounds read. Net: low real-world risk - a local attacker can only crash a client process, not gain data or code execution. |
| Exploit ScenarioDerived | An attacker on the same local network (LAN, Wi-Fi, or a compromised router) impersonates or spoofes a UPnP IGD gateway and returns a malformed device description or SOAP reply in which an XML element name ends in ':' at the very end of the buffer. When the victim's miniupnpc-based application parses it, parseelt reads one byte past the heap buffer and crashes the client. A publicly available POC demonstrating the out-of-bounds read exists; realistically this yields only a denial of service of the UPnP client, not code execution or data theft. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A one-byte heap out-of-bounds read in miniupnpc through 2.3.3 lets an attacker on the same local network crash a UPnP client by responding to discovery or SOAP traffic with a crafted XML element name that ends in a namespace-prefix colon. The minixml parser's parseelt function advances past the ':' character without re-checking the end-of-buffer pointer, so a single byte beyond the heap allocation is read, producing a client-side denial of service at worst. No CISA KEV listing exists, but publicly available exploit code exists (a technical write-up detailing the minixml OOB read), while the assessed impact is limited to availability loss (CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L; vendor score 2.3 on the CVSS 4.0 scale).
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the correction is commit 64ef08a12aabab57be0bf7e40f047c8f14dedf9c, which inserts an 'if (p->xml >= p->xmlend) return;' guard in parseelt after the namespace-prefix advance, applied across miniupnpc/src/minixml.c, miniupnpc-async/minixml.c, miniupnpc-libevent/minixml.c, and miniupnpd/minixml.c. Because no tagged patched release was independently verified, operators should either pull the commit directly or track the next miniupnpc release beyond 2.3.3 and rebuild every component that vendors a copy of minixml.c. Where rebuilding is not feasible, reduce exposure by disabling UPnP/IGD client discovery in applications that do not need it and by restricting such traffic to trusted network segments, since exploitation requires the attacker to be on the victim's local/adjacent network and to impersonate or spoof a UPnP gateway (AV:A, AT:P). Segmenting clients onto isolated VLANs or blocking SSDP/UPnP HTTP responses from untrusted hosts provides partial mitigation, with the trade-off of breaking legitimate gateway discovery; the underlying parsing flaw still exists in the binary until the bounds check is applied, so these controls should be treated as temporary. Note that the exposed path is a read-only OOB of a single byte, so a successful crash is the maximum observed effect - there is no evidence of code execution or data leakage that would justify emergency patching outside normal maintenance cycles.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
miniupnpc is the widely embedded C client library for UPnP IGD discovery and control, used by applications and routers to negotiate port mappings. Its bundled mini-XML parser (minixml.c), duplicated across miniupnpc/src, miniupnpc-async, miniupnpc-libevent, and miniupnpd, handles element names containing namespace prefixes separated by ':'. In parseelt, after the parser consumes the ':' it reads the next byte to continue namespace-prefix processing without confirming that the current position has not reached the xmlend sentinel - the root cause is a missing bounds check, classified as CWE-125 (Out-of-bounds Read). When the attacker's device description or SOAP response terminates an element name with a trailing ':' exactly at the end of the receive buffer, that read touches one byte past the heap allocation; it is a read, not a write, so there is no memory corruption primitive, no code execution path, and no data exfiltration avenue - only a possible crash if the adjacent byte falls in an unmapped page. The affected CPE is cpe:2.3:a:miniupnp_project:miniupnpc:*:*:*:*:*:*:*:*, covering all releases up to and including 2.3.3.
Know when Miniupnpc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Attacker must be on the local network as a malicious gateway (AV:A) and shape a specific end-of-buffer response (AC:H); client needs no credentials (PR:N) and the single-byte OOB read only crashes the process (A:L, C:N/I:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.201509
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read in the minixml parser's parseatt() routine: a malici
Exploit-DB