Live › vulnerability › CVE-2026-57486
Go to dashboardpupnp, a C SDK for UPnP devices and control points, dereferences NULL fields in ixmlNode_compare when comparing two non-namespaced XML attributes with the same name. An attacker who can feed crafted XML into an application using ixmlElement_removeAttributeNode can crash the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on pupnp before 2.0.2 that parse attacker-controlled XML and remove attribute nodes via ixmlElement_removeAttributeNode. Exposure depends on whether untrusted network input reaches that path, which the sources do not detail. Applications that only use pupnp against trusted local XML can skip it, though upgrading is still the fix.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pupnp project pupnp | vendor | < 2.0.2 | 2.0.2 |
2.0.2.ixmlElement_removeAttributeNode and ixmlDocument_createAttribute fed by network-received XML.2.0.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-57486")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.