The miniupnpd service in the miniupnp project contains an integer underflow vulnerability (CWE-191) in its handling of the SOAPAction HTTP header. Specifically, the ParseHttpHeaders() function performs insufficient length validation, causing the parsed length to underflow to a large unsigned integer when a malformed header with a single quote is processed. This leads to memchr() scanning memory beyond the allocated HTTP request buffer, resulting in an out-of-bounds memory read (CWE-125). This vulnerability can be exploited remotely without authentication and requires no user interaction, potentially causing denial of service or information disclosure.

Exploitation of this vulnerability can cause the miniupnpd process to read memory out-of-bounds, which may lead to denial of service or unintended information disclosure. The CVSS 4.0 score of 7.1 reflects a high severity impact with low attack complexity, no privileges required, and no user interaction needed. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing network-level protections such as filtering or blocking malformed SOAPAction headers to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.