CVE-2026-57486

HIGH 7.5

pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.

CWE	CWE-476
Vendor	pupnp
Product	pupnp
Published	Oct 16, 2026
Last Updated	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for pupnp pupnp

Be the first to know when new high vulnerabilities affecting pupnp pupnp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

pupnp / pupnp

< 2.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pupnp/pupnp/security/advisories/GHSA-q54q-vx78-v9rq github.com: https://github.com/pupnp/pupnp/commit/4b2f775e3b98de3cfb096707bcde040c5562d9ec github.com: https://github.com/pupnp/pupnp/releases/tag/release-2.0.2