Description
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.
Published: 2026-10-14
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via crash
Action: Patch Immediately
AI Analysis

Impact

miniupnpc versions up to 2.3.3 contain a vulnerability where the minixml parseelt function performs a one‑byte heap out‑of‑bounds read during namespace‑prefix handling. The bug occurs after advancing past a colon character without checking the end of the buffer. The result is a crash that can be triggered by malformed element names ending in ':' and does not lead to remote code execution or data disclosure.

Affected Systems

The affected product is miniupnpc from the miniupnp project, specifically all releases through 2.3.3. Devices or hosts running these versions on local networks are at risk if they accept UPnP device descriptions or SOAP replies from a gateway.

Risk and Exploitability

The CVSS score of 2.3 indicates a low severity denial‑of‑service issue. The EPSS score is <1% (≈0.29%) and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious or spoofed UPnP gateway on the local network that sends a specially crafted device description or SOAP reply to the client, causing the client to crash.

Generated by OpenCVE AI on October 15, 2026 at 19:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade miniupnpc to the latest available release that includes the fix (for example, 2.3.4 or later).
  • If an upgrade cannot be performed immediately, limit UPnP traffic to trusted network interfaces and disable UPnP discovery on untrusted networks to reduce exposure.
  • Continuously monitor the client for unexpected crashes or memory errors, and apply timely patches once they become available.

Generated by OpenCVE AI on October 15, 2026 at 19:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.
Title miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt
First Time appeared Miniupnp Project
Miniupnp Project miniupnpc
Weaknesses CWE-125
CPEs cpe:2.3:a:miniupnp_project:miniupnpc:*:*:*:*:*:*:*:*
Vendors & Products Miniupnp Project
Miniupnp Project miniupnpc
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Miniupnp Project Miniupnpc
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-09T16:32:12.613Z

Reserved: 2026-10-14T13:08:39.334Z

Link: CVE-2026-110656

cve-icon Vulnrichment

Updated: 2026-11-09T16:32:08.392Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T16:17:42.363

Modified: 2026-11-09T17:17:08.557

Link: CVE-2026-110656

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T11:30:07Z

Weaknesses