CVE-2026-110655 Details
Description
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
A heap out-of-bounds read vulnerability has been identified in the MiniUPnP client library, specifically in versions through 2.3.3. The issue arises in the hand-written XML parser within the 'minixml' component, where the 'parseatt' function improperly handles attribute names in crafted UPnP replies. This vulnerability allows malicious UPnP gateways to read past buffer limits, potentially leading to a crash of the MiniUPnP client. The flaw can be exploited by attackers on the same local network segment, who can spoof gateway responses to trigger the out-of-bounds read.
Users can update to MiniUPnP version 2.3.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| miniupnpc | <= 2.3.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |