CVE-2026-110655 in miniupnpc
Summary
by MITRE • 10/15/2026
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The miniupnpc library, widely utilized for Universal Plug and Play (UPnP) discovery and control point operations, contains a critical heap-based out-of-bounds read vulnerability within its minixml parsing component. Specifically located in the parseatt function of version 2.3.3 and earlier releases, this flaw arises from insufficient boundary checks when processing XML attributes received during UPnP communication sequences. The vulnerability is triggered when the library processes device descriptions or SOAP responses that contain crafted attribute values ending with an equals sign. This specific character sequence allows a malicious actor to manipulate the internal pointer arithmetic of the parser, causing it to read memory locations beyond the allocated buffer boundaries.
From a technical perspective, this issue classifies as CWE-125: Out-of-bounds Read, which is a subset of improper input validation that leads to information disclosure or denial of service conditions. The minixml library serves as the underlying XML parser for miniupnpc, and its failure to validate array indices before accessing memory elements creates a classic buffer over-read scenario. When a crafted reply containing an equals sign at the end of an attribute value is processed, the parsing logic fails to account for the actual length of the string versus the allocated heap space. This results in the application reading arbitrary bytes from adjacent memory regions that are not part of the intended data structure.
The operational impact of this vulnerability primarily centers on denial of service and potential information leakage within local network environments. Since UPnP is designed to facilitate automatic device discovery and configuration, clients often trust responses from gateways without rigorous validation in legacy implementations. An attacker positioned on the same local area network can exploit this by spoofing a malicious gateway or intercepting traffic to inject crafted SOAP responses. By sending these specially formatted replies, the attacker forces the miniupnpc client to execute the flawed parsing routine. The immediate consequence is often a segmentation fault or application crash due to accessing invalid memory addresses, effectively disrupting UPnP services for the affected system. In more sophisticated scenarios involving specific compiler optimizations and heap layouts, reading out-of-bounds data could potentially leak sensitive information from adjacent memory blocks, although denial of service remains the most consistent and exploitable outcome in typical deployment contexts.
This vulnerability aligns with MITRE ATT&CK technique T1046: Network Service Discovery, where adversaries use protocols like UPnP to map network topology or disrupt services. The attack vector is classified as Local (Network), requiring the attacker to have access to the same broadcast domain as the victim machine. Mitigation strategies should prioritize immediate updates to miniupnpc version 2.3.4 or later, which includes patches for this heap boundary check failure. In environments where upgrading is not immediately feasible, network segmentation policies can be implemented to restrict UPnP traffic between untrusted devices and critical infrastructure hosts. Additionally, deploying intrusion detection systems capable of identifying malformed XML structures in UPnP SOAP messages may provide an additional layer of defense against exploitation attempts targeting legacy clients that have not yet been patched.