Skip to content
OpenAdvisories
High · 7.5 CVE-2026-57486 EUVD-2026-102928

pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes

Published Oct 16, 2026 · Updated Oct 16, 2026 · Assigned by GitHub_M

Description

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.

Affected products

VendorProductAffectedFixed
pupnp pupnp < 2.0.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 pupnp 1:22.1.8-2 —
Debian 13 pupnp No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 pupnp No fix yet —
Ubuntu 26.04 LTS pupnp No fix yet —
Ubuntu 24.04 LTS pupnp No fix yet —
Ubuntu 22.04 LTS pupnp-1.8 No fix yet —
Ubuntu 20.04 LTS pupnp-1.8 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS libupnp +1 No fix yet —
Ubuntu 16.04 LTS mediatomb No fix yet —
Ubuntu Pro 16.04 LTS libupnp No fix yet —

References