CVE-2026-57486
Received Received - Intake

pupnp NULL Pointer Dereference in Attribute Comparison

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-57486
EUVD
EUVD-2026-102928

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pupnp pupnp < 2.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in pupnp versions before 2.0.2 involves a NULL pointer dereference in the ixmlNode_compare function. When processing XML with non-namespaced attributes, the function compares attribute objects and crashes due to NULL values in nodeValue, namespaceURI, prefix, or localName fields.

Detection Guidance

This vulnerability can be detected by checking the version of pupnp installed on your system. If the version is below 2.0.2, the system is vulnerable. Use commands like 'pkg-config --modversion libpupnp' or 'dpkg -l | grep pupnp' to check the installed version.

Impact Analysis

An attacker could exploit this by providing malicious XML input to crash applications using affected pupnp versions. This could lead to denial-of-service conditions, disrupting services relying on UPnP functionality.

Compliance Impact

This vulnerability primarily causes denial-of-service (DoS) conditions by crashing applications processing attacker-controlled XML. It does not directly impact data confidentiality, integrity, or privacy required by standards like GDPR or HIPAA. However, persistent DoS attacks could disrupt services handling sensitive data, potentially leading to compliance violations if critical systems become unavailable.

Mitigation Strategies

Immediately update pupnp to version 2.0.2 or later. If updating is not possible, consider disabling UPnP services or restricting access to XML parsing functions until the update can be applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57486. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart