{"id":"CVE-2026-110656","summary":"miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt","details":"miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.","modified":"2026-10-16T07:08:24.221377291Z","published":"2026-10-14T15:01:23.198Z","database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110656.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110656.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110656"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/miniupnpc-through-2.3.3-heap-out-of-bounds-read-via-minixml-parseelt"},{"type":"FIX","url":"https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c"},{"type":"PACKAGE","url":"https://github.com/miniupnp/miniupnp"},{"type":"ARTICLE","url":"https://github.com/miniupnp/miniupnp/blob/bf4215a7574f88aa55859db9db00e3ae58cf42d6/miniupnpc/src/minixml.c#L141"},{"type":"EVIDENCE","url":"https://hackmd.io/@haind-pwn/miniupnpc-minixml-oob-read"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/miniupnp/miniupnp","events":[{"introduced":"0"},{"fixed":"e439318cf782e30066d430f27a1365e013a5ab94"},{"fixed":"64ef08a12aabab57be0bf7e40f047c8f14dedf9c"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"2.3.3"}]}}],"versions":["miniupnpd_2_3_2","minissdpd_1_6_0","miniupnpc_2_2_4","miniupnpd_2_3_1","miniupnpd_2_3_0","miniupnpc_2_2_3","miniupnpd_2_2_3","miniupnpd_2_2_2","miniupnpc_2_2_2","miniupnpd_2_2_1","miniupnpc_2_2_1","miniupnpc_2_2_0","miniupnpd_2_2_0","miniupnpd_2_1","miniupnpc_2_1","minissdpd_1_4","miniupnpc_1_9","miniupnpd_1_8","miniupnpc_1_8","miniupnpd_1_7","minissdpd_1_2","miniupnpc_1_7"],"database_specific":{"vanir_signatures_modified":"2026-10-16T07:08:24Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110656.json","vanir_signatures":[{"digest":{"function_hash":"194079372695373320339902764288383349741","length":2252},"id":"CVE-2026-110656-07e1c319","signature_type":"Function","signature_version":"v1","source":"https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c","target":{"file":"miniupnpd/minixml.c","function":"parseelt"},"deprecated":false},{"id":"CVE-2026-110656-10413f75","signature_type":"Line","signature_version":"v1","source":"https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c","target":{"file":"miniupnpc-libevent/minixml.c"},"deprecated":false,"digest":{"line_hashes":["36391078159261585522920684177741111325","71057003713681299381408400123257268555","167977498215211983789542493163770037391","199841563007767732473341076084208574060"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c","target":{"file":"miniupnpc-libevent/minixml.c","function":"parseelt"},"deprecated":false,"digest":{"function_hash":"194079372695373320339902764288383349741","length":2252},"id":"CVE-2026-110656-2f2926be"},{"id":"CVE-2026-110656-3eb95e29","signature_type":"Line","signature_version":"v1","source":"https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c","target":{"file":"miniupnpc/src/minixml.c"},"deprecated":false,"digest":{"line_hashes":["36391078159261585522920684177741111325","71057003713681299381408400123257268555","167977498215211983789542493163770037391","199841563007767732473341076084208574060"],"threshold":0.9}},{"digest":{"threshold":0.9,"line_hashes":["36391078159261585522920684177741111325","71057003713681299381408400123257268555","167977498215211983789542493163770037391","199841563007767732473341076084208574060"]},"id":"CVE-2026-110656-41399a99","signature_type":"Line","signature_version":"v1","source":"https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c","target":{"file":"miniupnpc-async/minixml.c"},"deprecated":false},{"digest":{"length":2252,"function_hash":"194079372695373320339902764288383349741"},"id":"CVE-2026-110656-5ff49152","signature_type":"Function","signature_version":"v1","source":"https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c","target":{"file":"miniupnpc-async/minixml.c","function":"parseelt"},"deprecated":false},{"id":"CVE-2026-110656-a7269ea2","signature_type":"Line","signature_version":"v1","source":"https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c","target":{"file":"miniupnpd/minixml.c"},"deprecated":false,"digest":{"line_hashes":["36391078159261585522920684177741111325","71057003713681299381408400123257268555","167977498215211983789542493163770037391","199841563007767732473341076084208574060"],"threshold":0.9}},{"target":{"file":"miniupnpc/src/minixml.c","function":"parseelt"},"deprecated":false,"digest":{"function_hash":"194079372695373320339902764288383349741","length":2252},"id":"CVE-2026-110656-df5af939","signature_type":"Function","signature_version":"v1","source":"https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}