CVE Feed

    Dashboard / CVE / CVE-2026-57486

    CVE-2026-57486

    pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.

    Published:Oct 16, 2026
    Last Modified:Oct 23, 2026
    EPS:Oct 16, 2026
    EPSS Score:0.00411
    CVSS Score:7.5

    Affected Products

    Vendor
    Pupnp
    Product
    Pupnp
    Vendor
    Pupnp Project
    Product
    Pupnp

    Exploits

    https://github.com/pupnp/pupnp/security/advisories/GHSA-q54q-vx78-v9rqhttps://github.com/pupnp/pupnp/security/advisories/GHSA-q54q-vx78-v9rq

    Common Weakness Enumeration

    CWE-476 NULL Pointer Dereference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High