Cyber Posture

CVE-2026-5720

CriticalPublic PoCUpdated

Published: 17 April 2026

Published
17 April 2026
Modified
11 May 2026
KEV Added
—
Patch
—
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS Score 0.0015 34.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5720 is a critical-severity Out-of-bounds Read (CWE-125) vulnerability in Miniupnp Project Miniupnpd. Its CVSS base score is 9.1 (Critical).

Operationally, ranked at the 34.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

NVD Description

miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Attackers can trigger an out-of-bounds memory read…

more

by exploiting improper length validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer.

Deeper analysisAI

Automated synthesis unavailable for this CVE.

Details

CWE(s)
CWE-125CWE-191

Affected Products

miniupnp project
miniupnpd
≤ 2.3.10

References