CVE-2026-110655 miniupnp project CVE debrief

Who should care

Defenders responsible for systems or networks utilizing miniupnpc should assess exposure and prioritize verification and potential updates. This includes reviewing UPnP gateway configurations and monitoring local network traffic for suspicious activity.

Why it matters

Defenders should care about CVE-2026-110655 because it allows malicious UPnP gateways to potentially crash clients and disclose information. The vulnerability requires verification of miniupnpc versions and configurations, and monitoring of local network traffic. The impact is relatively low but still significant for affected systems.

• Potential client crashes due to out-of-bounds reads
• Possible information disclosure through crafted gateway replies
• Need for verification of miniupnpc version and secure configurations
• Potential for denial-of-service attacks through spoofed gateway activity

Technical summary

The miniupnpc library through version 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function. This vulnerability allows malicious UPnP gateways to read past buffer bounds via crafted replies, potentially crashing the client. The vulnerability is triggered when the client processes device descriptions or SOAP responses ending in '=' from a spoofed gateway on the local network.

Defensive priority

Defenders should prioritize verifying and updating miniupnpc to a version beyond 2.3.3 if possible, and monitor local network traffic for suspicious UPnP gateway activity.

Recommended defensive actions

• Verify miniupnpc version and update to a version beyond 2.3.3 if possible
• Monitor local network traffic for suspicious UPnP gateway activity
• Review and implement secure UPnP gateway configurations
• Conduct a thorough review of affected product deployments in managed environments
• Assign an owner for follow-up on verification and potential updates of miniupnpc
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact and potential attack vectors. However, there is limited information on affected versions beyond 2.3.3 and no explicit mention of exploitation in the wild.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.