miniupnpc up to version 2.3.3 contains a one‑byte heap out‑of‑bounds read in the minixml parseatt function (CWE‑125). A local attacker can supply crafted UPnP device descriptions or SOAP responses ending in '=' to cause the client to read beyond the allocated buffer, potentially exposing sensitive data or causing a crash. This weakness does not grant code execution or raise privileges.

The vulnerable component is the miniupnpc library from the miniupnp project. All installations of miniupnpc 2.3.3 or earlier that process UPnP traffic are impacted. Hosts or devices running this library on a local network may be affected.

The CVSS base score of 2.3 indicates low severity, and the EPSS score of <1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to be on the same local network and control a UPnP gateway that can serve malformed responses. When these conditions are met, the client may crash or leak memory contents, but broader impacts are unlikely without further compromise.