CVE-2026-107159
Received Received - Intake

MiniUPnPd Daemon Divide-by-Zero Vulnerability

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: VulnCheck

Description
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-107159
EUVD
EUVD-2026-94308

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
miniupnp project miniupnpd 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-369 The product divides a value by zero.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a divide-by-zero flaw in MiniUPnPd through version 2.3.11 when built with the --strict option. It occurs in the ProcessSSDPData() function during SSDP request handling. Attackers on the local network can send a crafted multicast M-SEARCH datagram with MX: 0 and a known ST header to port 1900, causing a SIGFPE crash that denies UPnP IGD service.

Detection Guidance

To detect this vulnerability, monitor for crashes in miniupnpd when receiving multicast M-SEARCH packets with MX: 0. Use packet capture tools like tcpdump to inspect SSDP traffic on port 1900 for malformed MX headers. Check logs for SIGFPE errors in miniupnpd processes.

Impact Analysis

The vulnerability allows unauthenticated local network attackers to crash the MiniUPnPd daemon, disrupting UPnP IGD services. This can prevent devices from properly managing network ports, affecting NAT traversal, online gaming, file sharing, or other services relying on UPnP functionality.

Mitigation Strategies

Immediately update miniupnpd to the latest patched version. If using --strict build option, ensure MX validation is enforced. Block external access to port 1900 via firewall rules. Monitor for suspicious SSDP traffic with MX: 0.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107159. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart