Based on the updated description, SWUpdate contains an integer underflow in the multipart upload parser within mg_http_multipart_continue_wait_for_chunk() in mongoose_multipart.c. A crafted HTTP POST to /upload with a malformed multipart boundary and controlled TCP stream timing can trigger the underflow when the buffer length falls within a specific range, resulting in an out‑of‑bounds heap read past the allocated receive buffer into a local IPC socket. This corrupts internal structures, causing the update daemon to crash and denying service. The weakness maps to CWE‑125 and CWE‑191.

The vulnerable code resides in the SWUpdate project maintained by sbabic. No explicit version range is provided; the flaw exists in the code as of the referenced commit. Any system running SWUpdate without the applied changes from that commit is susceptible to exploitation.

The CVSS score of 8.2 indicates high severity, but the EPSS score is less than 1%, suggesting that while the exploit can be achieved, its likelihood of emerging in the wild is low at present. The vulnerability is not in the CISA KEV catalog. Exploitation requires unauthenticated access to the /upload endpoint and the ability to send a crafted request; attack can be performed from any network location that can reach the endpoint. Successful exploitation would disrupt the OTA update process and could be leveraged for repeated denial‑of‑service attacks against affected devices.