Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110656miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt

Low 3.1

In plain English

A low-severity out-of-bounds read in miniupnpc from miniupnp project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.3%top 78.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12miniupnpcno fix listedDEBIAN-CVE-2026-110656
Debian:13miniupnpcno fix listedDEBIAN-CVE-2026-110656
Debian:14miniupnpcno fix listedDEBIAN-CVE-2026-110656
Ubuntu:22.04:LTSminiupnpcno fix listedUBUNTU-CVE-2026-110656
Ubuntu:24.04:LTSminiupnpcno fix listedUBUNTU-CVE-2026-110656
Ubuntu:26.04:LTSminiupnpcno fix listedUBUNTU-CVE-2026-110656
Ubuntu:26.10miniupnpcno fix listedUBUNTU-CVE-2026-110656

Affected products (as reported)

VendorProductVersions
miniupnp project miniupnpc 0 – through 2.3.3

Weakness: CWE-125 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References