CVE-2026-57486
7.5HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-476
Impact
Remote, unauthenticated attackers can crash services running pupnp by sending specially crafted XML to trigger a denial of service. Exploitation requires the target application to process attacker-controlled XML that removes attribute nodes.
Root cause
The ixmlNode_compare function passes nullable node fields directly to strcmp without null checks, causing a NULL pointer dereference during attribute comparison.
Affected systems
pupnp prior to version 2.0.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade pupnp to version 2.0.2 or later. If patching immediately is not possible, block untrusted network traffic to the UPnP service at the firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.