CVE-2026-28525 describes an integer underflow vulnerability (CWE-191) in the multipart upload parser of SWUpdate (sbabic project), specifically in mongoose_multipart.c. The issue arises when an attacker sends a specially crafted HTTP POST request to the /upload endpoint with a malformed multipart boundary and manipulates TCP stream timing. This triggers an integer underflow in the mg_http_multipart_continue_wait_for_chunk() function when the buffer length falls within a certain range, causing an out-of-bounds heap read beyond the allocated receive buffer to a local IPC socket. The vulnerability can be exploited without authentication and results in denial of service.

An unauthenticated attacker can cause a denial of service condition by triggering an integer underflow that leads to an out-of-bounds heap read. This may crash the application or destabilize the system running SWUpdate. There is no indication of code execution or data disclosure from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, restricting access to the /upload endpoint and monitoring for suspicious HTTP POST requests with malformed multipart boundaries may reduce exposure.