{"id":"CVE-2026-57486","kind":"vulnerability","aliases":["CVE-2026-57486"],"related":[],"title":"pupnp: NULL attribute field crash when removing XML attributes","description":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.","summary":"pupnp, a C SDK for UPnP devices and control points, dereferences NULL fields in ixmlNode_compare when comparing two non-namespaced XML attributes with the same name. An attacker who can feed crafted XML into an application using ixmlElement_removeAttributeNode can crash the process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pupnp project pupnp","fixed":["2.0.2"],"affected":"< 2.0.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["c","embedded","iot","package","upnp"],"not_affected_if":["no-untrusted-xml","pinned-2.0.2-or-later"],"how_to_check":"- Check the pupnp version your application links against; affected versions are below `2.0.2`.\n- Search your code for calls to `ixmlElement_removeAttributeNode` and `ixmlDocument_createAttribute` fed by network-received XML.","fix":"- Upgrade pupnp to `2.0.2` or later.","status":"open","published_at":"2026-10-16T16:18:44+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:25:00+00:00","updated_at":"2026-10-25T03:25:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:25:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pupnp to `2.0.2` or later.","reach":"unknown","title":"pupnp: NULL attribute field crash when removing XML attributes","impact":"low","summary":"pupnp, a C SDK for UPnP devices and control points, dereferences NULL fields in ixmlNode_compare when comparing two non-namespaced XML attributes with the same name. An attacker who can feed crafted XML into an application using ixmlElement_removeAttributeNode can crash the process.","category":"package","nicknames":[],"who_cares":["c","upnp","iot","embedded"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Process crashes when attacker-controlled XML triggers the NULL dereference","analyst_note":"","how_to_check":"- Check the pupnp version your application links against; affected versions are below `2.0.2`.\n- Search your code for calls to `ixmlElement_removeAttributeNode` and `ixmlDocument_createAttribute` fed by network-received XML.","needs_analyst":false,"not_affected_if":["pinned-2.0.2-or-later","no-untrusted-xml"],"who_is_affected":"Applications built on pupnp before 2.0.2 that parse attacker-controlled XML and remove attribute nodes via ixmlElement_removeAttributeNode. Exposure depends on whether untrusted network input reaches that path, which the sources do not detail. Applications that only use pupnp against trusted local XML can skip it, though upgrading is still the fix.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000629,"input_tokens":3480,"output_tokens":562,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-57486':12A,15A '2.0.2':84C,163C 'appli':137C 'applic':61B,81C,148C 'attack':53B,152C 'attacker-control':151C 'attribut':3A,9A,47B,104C,120C 'c':19B,26B 'caus':143C 'compar':39B,41B,86C,117C 'comparison':140C 'condit':128C 'control':32B,79C,153C 'craft':57B 'crash':5A,66B,146C 'creat':105C 'createattribut':108C 'cve':10A,13A 'derefer':34B,141C 'develop':74C 'devic':30B,77C 'direct':98C 'distinct':119C 'embed':20B 'feed':56B 'field':4A,36B,97C,112C 'find':127C 'fix':161C 'handl':149C 'ident':133C 'iot':21B 'issu':159C 'ixml/src/node.c':88C 'ixmldocu':107C 'ixmlel':63B,115C 'ixmlnod':38B,85C 'leav':110C 'legitim':109C 'localnam':96C 'name':51B 'namespac':45B,103C 'namespaceuri':93C 'node':129C 'nodenam':125C 'nodevalu':92C 'non':44B,102C 'non-namespac':43B,101C 'null':2A,35B,113C,142C 'nullabl':91C 'object':121C 'packag':22B 'pass':89C 'path':157C 'point':33B,80C 'pointer':132C 'pointer-ident':131C 'prefix':94C 'prior':82C 'process':68B,145C 'project':17A 'pupnp':1A,16A,18A,24B,69C 'reach':155C 'remov':7A 'removeattributenod':64B,116C 'sdk':27B,72C 'shortcut':134C 'strcmp':100C 'two':42B,118C 'upnp':23B,29B,76C 'use':62B 'xml':8A,46B,58B,154C","nicknames":[],"mitigations":[],"who_affected":"Applications built on pupnp before 2.0.2 that parse attacker-controlled XML and remove attribute nodes via ixmlElement_removeAttributeNode. Exposure depends on whether untrusted network input reaches that path, which the sources do not detail. Applications that only use pupnp against trusted local XML can skip it, though upgrading is still the fix.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57486","severity":null,"published_at":"2026-10-16T16:18:44+00:00","modified_at":"2026-10-23T16:07:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}