Integer Underflow Vulnerability in miniupnpd by MiniUPnP

CVE-2026-5720

What is CVE-2026-5720?

The miniupnpd software is affected by an integer underflow vulnerability due to improper parsing of the SOAPAction header. This flaw allows remote attackers to craft malicious requests that lead to denial of service or expose sensitive information. The vulnerability arises when the parsed length of the SOAPAction header underflows, causing an out-of-bounds memory read during HTTP request processing. Specifically, when a single quote is included in the SOAPAction header, it triggers unsafe memory access, potentially leading to severe disruptions in service or data exposure.

References