CVE-2026-28525 Details

A denial-of-service vulnerability has been identified in SWUpdate versions through 2025.12. The issue arises from an integer underflow in the multipart upload parser within 'mongoose_multipart.c'. This vulnerability allows unauthenticated attackers to cause a denial-of-service by sending a crafted HTTP POST request to '/upload' with a malformed multipart boundary and controlled TCP stream timing. Exploitation triggers an integer underflow in the 'mg_http_multipart_continue_wait_for_chunk()' function, leading to an out-of-bounds heap read. This read writes data beyond the allocated receive buffer to a local IPC socket.

Users can upgrade to SWUpdate versions released after the vulnerability was patched in the 2025.12 version. The patch is available in the commit beee2dc on the SWUpdate GitHub repository.