The miniupnpd service in the miniupnp project contains an integer underflow vulnerability (CWE-191) in its SOAPAction header parsing logic. Specifically, the function ParseHttpHeaders() improperly validates the length of the header, which can underflow to a large unsigned integer when a malformed SOAPAction header with a single quote is processed. This underflow causes memchr() to scan memory beyond the allocated HTTP request buffer, resulting in an out-of-bounds memory read (CWE-125). The vulnerability can be exploited remotely without authentication or user interaction, potentially leading to denial of service or information disclosure.

Successful exploitation of this vulnerability can cause the miniupnpd process to read memory out-of-bounds, which may lead to denial of service or leakage of sensitive information from memory. The CVSS 4.0 base score is 7.1 (high severity), reflecting the remote attack vector with low complexity and no required privileges or user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Users should monitor the miniupnp project advisories for updates. Until a patch is released, consider limiting exposure of miniupnpd services to untrusted networks to reduce risk.