CVE-2026-28525 is an integer underflow vulnerability in the multipart upload parser of sbabic's SWUpdate software, specifically in mongoose_multipart.c. The flaw occurs when processing a malformed multipart boundary in an HTTP POST request to /upload, combined with controlled TCP stream timing. This triggers an integer underflow in the mg_http_multipart_continue_wait_for_chunk() function when the buffer length is within a certain range, resulting in an out-of-bounds heap read beyond the allocated receive buffer to a local IPC socket. The vulnerability can be exploited without authentication and may cause denial of service.

Successful exploitation allows unauthenticated attackers to cause a denial of service by triggering an out-of-bounds heap read due to integer underflow. This may crash the application or disrupt its normal operation. There is no indication from the data that code execution or data disclosure is possible. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is available at this time, users should monitor vendor communications for updates. Until a patch is released, consider restricting access to the /upload endpoint or implementing network-level protections to limit exposure to unauthenticated HTTP POST requests with multipart data.