Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57486— pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes

Quick assessment

Affected
pupnp pupnp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pupnp 是一个用于开发 UPnP 设备和控制点应用程序的软件开发工具包（SDK）。在版本 2.0.2 之前， 中的 函数会将 、 、 和 这些可为 NULL 的字段直接传递给 函数。由 创建的无命名空间属性，其上述字段合法地为 NULL。当 通过 比较两个具有相同 但彼此不同的属性对象时，由于无法应用指针恒等性（pointer-identity）快捷路径，比较过程会解引用 NULL 指针，从而导致进程崩溃。当应用程序处理由攻击者控制的 XML 并触发此执行路径时，即会引发该漏洞。该问题已在版本 2.0.2 中修

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
pupnp pupnp < 2.0.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57486

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
Source: CVE Program / CVE List V5
Vulnerability Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pupnp pupnp < 2.0.2 -

II. Public POCs for CVE-2026-57486

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57486

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-57486 (1)

Vendor Pages for CVE-2026-57486 (1)

Same Patch Batch · pupnp · 2026-10-16 · 5 CVEs total

CVE-2026-57487 7.5 HIGH libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
CVE-2026-77630 7.5 HIGH pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
CVE-2026-57488 7.1 HIGH pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
CVE-2026-55862 6.5 MEDIUM pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow

IV. Related Vulnerabilities

Same product: pupnp
Same vendor: pupnp
Same weakness: CWE-476

V. Comments for CVE-2026-57486

No comments yet

Leave a comment