{"id":"CVE-2026-110655","summary":"miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt","details":"miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.","modified":"2026-10-15T10:31:02.880211962Z","published":"2026-10-14T15:01:22.499Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110655.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110655.json"},{"type":"PACKAGE","url":"https://github.com/miniupnp/miniupnp"},{"type":"ARTICLE","url":"https://github.com/miniupnp/miniupnp/blob/bf4215a7574f88aa55859db9db00e3ae58cf42d6/miniupnpc/src/minixml.c#L61"},{"type":"FIX","url":"https://github.com/miniupnp/miniupnp/commit/3cfb4fb78d5ac04ed0dadc8dd842fc9e448916db"},{"type":"EVIDENCE","url":"https://hackmd.io/@haind-pwn/miniupnpc-minixml-oob-read"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110655"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/miniupnpc-through-2.3.3-heap-out-of-bounds-read-via-minixml-parseatt"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/miniupnp/miniupnp","events":[{"introduced":"0"},{"last_affected":"e439318cf782e30066d430f27a1365e013a5ab94"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"2.3.3"}]}}],"versions":["miniupnpd_2_3_3","miniupnpd_2_3_2","minissdpd_1_6_0","miniupnpc_2_2_4","miniupnpd_2_3_1","miniupnpd_2_3_0","miniupnpc_2_2_3","miniupnpd_2_2_3","miniupnpd_2_2_2","miniupnpc_2_2_2","miniupnpd_2_2_1","miniupnpc_2_2_1","miniupnpc_2_2_0","miniupnpd_2_2_0","miniupnpd_2_1","miniupnpc_2_1","minissdpd_1_4","miniupnpc_1_9","miniupnpd_1_8","miniupnpc_1_8","miniupnpd_1_7","minissdpd_1_2","miniupnpc_1_7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110655.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}