Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.
Published: 2026-10-16
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

A null pointer dereference arises in ixmlNode_compare of the pupnp SDK when an attribute lacking a namespace is removed, because the function calls strcmp on pointer fields that are legitimately NULL. The crash terminates the application handling the XML, producing an immediate denial of service. No data exfiltration or code execution occurs, but the application’s availability is disrupted.

Affected Systems

The vulnerability affects the pupnp SDK, specifically all releases prior to version 2.0.2. Any application built with the older SDK that parses or manipulates UPnP XML may experience a crash when encountering non‑namespaced attributes created by an attacker or malformed input.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, but the EPSS score is not available and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote: an attacker can supply malicious XML over the network to a UPnP‑enabled application, triggering the crash through attribute removal. While no public exploit has been reported, the high impact makes immediate remediation prudent.

Generated by OpenCVE AI on October 16, 2026 at 17:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the pupnp library to release 2.0.2 or later to obtain the fixed comparison logic.
  • If an upgrade cannot be applied immediately, block or limit incoming UPnP XML from untrusted sources to prevent the malicious attribute handling path from executing.
  • In custom code that creates or removes XML attributes, add explicit null checks before calling string comparison functions to avoid dereferencing NULL pointers.

Generated by OpenCVE AI on October 16, 2026 at 17:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Pupnp Project
Pupnp Project pupnp
CPEs cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:*
Vendors & Products Pupnp Project
Pupnp Project pupnp

Fri, 23 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Pupnp
Pupnp pupnp
Vendors & Products Pupnp
Pupnp pupnp

Fri, 16 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.
Title pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Pupnp Pupnp
Pupnp Project Pupnp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-16T15:56:47.362Z

Reserved: 2026-06-24T14:53:40.111Z

Link: CVE-2026-57486

cve-icon Vulnrichment

Updated: 2026-10-16T15:56:40.451Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-16T16:18:44.510

Modified: 2026-10-23T16:07:55.893

Link: CVE-2026-57486

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T10:30:08Z

Weaknesses