Heap Out-of-Bounds Read in miniupnpc

Executive Summary

CVE-2026-110655 is a low-severity heap out-of-bounds read flaw in miniupnpc through version 2.3.3. It occurs in the minixml parseatt function when parsing XML attributes. Malicious UPnP gateways on the local network can send crafted replies ending with '=' to trigger a one-byte read past the allocated buffer, causing client crashes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses miniupnpc version 2.3.3 or earlier. Run 'miniupnpc -v' or inspect package versions on Linux (e.g., 'dpkg -l | grep miniupnpc'). Monitor network traffic for UPnP gateway responses ending in '=' using tools like Wireshark or tcpdump.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers on the same local network to crash applications using miniupnpc by sending malformed UPnP responses. It does not enable data theft or code execution but may disrupt services relying on UPnP for network functions like port mapping.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a low-severity issue causing crashes without information disclosure or code execution. It may indirectly impact compliance if UPnP services are exposed to untrusted networks, violating best practices for network segmentation required by these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update miniupnpc to the latest version beyond 2.3.3. If updating is not possible, disable UPnP services on your gateway or client devices. Restrict UPnP traffic to trusted local networks only. Block external access to UPnP ports (typically UDP 1900, TCP 2869).

Useful 0 Not Useful 0