CVE-2026-110655: Out-of-bounds Read in miniupnp project miniupnpc

The miniupnpc library versions up to 2.3.3 contain a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function. This vulnerability can be triggered by a malicious UPnP gateway that sends device descriptions or SOAP responses ending with an '=' character, causing the client to read beyond the allocated buffer. The vulnerability requires an attacker to be on the local network and able to spoof a UPnP gateway. The CVSS 4.0 base score is 2.3, indicating low severity, with attack vector as adjacent network and high attack complexity.

An attacker on the local network can exploit this vulnerability by spoofing a UPnP gateway and sending crafted responses that cause the miniupnpc client to perform an out-of-bounds read. This can lead to a crash of the client application. There is no indication of code execution or data disclosure beyond the out-of-bounds read. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network administrators should consider limiting exposure to untrusted UPnP gateways on the local network. No official patch or workaround information is provided in the current data.