Heap Out-of-Bounds Read in miniupnpc

Executive Summary

CVE-2026-110656 is a low-severity heap out-of-bounds read in miniupnpc versions up to 2.3.3. It occurs in the minixml parseelt function when handling namespace prefixes. The parser skips a buffer end check after advancing past a colon (:) in an element name. A malicious UPnP gateway on the local network can send a response with an element name ending in a colon to crash the client.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses miniupnpc version 2.3.3 or earlier. Run 'miniupnpc -v' or check package versions with 'dpkg -l | grep miniupnpc' on Debian/Ubuntu or 'rpm -qa | grep miniupnpc' on RPM-based systems. Monitor network traffic for UPnP responses ending with ':' as they may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service by crashing applications using miniupnpc. It requires an attacker to be on the local network to send a spoofed UPnP gateway response. The impact is limited to crashes with no code execution or data theft, as the out-of-bounds read only affects parser control flow.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by crashing applications using miniupnpc, with no evidence of data exposure or code execution. It does not directly impact GDPR or HIPAA compliance as it does not lead to unauthorized data access, processing, or disclosure. However, repeated crashes could disrupt services handling sensitive data, potentially affecting availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update miniupnpc to the latest version using your package manager (e.g., 'apt upgrade miniupnpc' or 'yum update miniupnpc'). If no update is available, disable UPnP services or restrict UPnP traffic to trusted local networks only. Block external access to UPnP ports (typically UDP 1900 and TCP 2869).

Useful 0 Not Useful 0