CVE-2026-57486

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57486
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57486.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57486
Aliases
  • GHSA-q54q-vx78-v9rq
Downstream
Published
2026-10-16T15:32:57Z
Modified
2026-10-17T07:05:58Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
Details

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-476"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57486.json"
}
References

Affected packages

Git / github.com/pupnp/pupnp

Affected ranges

Type
GIT
Repo
https://github.com/pupnp/pupnp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
280cff736ee0a2384d8a67011382e6fe76a51167
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.0.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
last_svn_trunk
release-1.*
release-1.10.0
release-1.10.1
release-1.12.0
release-1.14.0
release-1.14.1
release-1.14.10
release-1.14.11
release-1.14.12
release-1.14.13
release-1.14.14
release-1.14.15
release-1.14.16
release-1.14.17
release-1.14.18
release-1.14.19
release-1.14.2
release-1.14.20
release-1.14.21
release-1.14.22
release-1.14.23
release-1.14.24
release-1.14.25
release-1.14.26
release-1.14.27
release-1.14.28
release-1.14.29
release-1.14.3
release-1.14.30
release-1.14.4
release-1.14.5
release-1.14.6
release-1.14.7
release-1.14.8
release-1.14.9
release-1.18.0
release-1.18.1
release-1.18.2
release-1.18.3
release-1.18.4
release-1.18.5
release-1.8.0
release-1.8.1
release-1.8.2
release-1.8.3
release-1.8.4
release-2.*
release-2.0.0
release-2.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57486.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "52107601416279361396342264133200996176",
            "length":  476
        },
        "id":  "CVE-2026-57486-69243614",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pupnp/pupnp/commit/280cff736ee0a2384d8a67011382e6fe76a51167",
        "target":  {
            "file":  "ixml/test/poc_ghsa_q54q.c",
            "function":  "main"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "334027813865936129438216410789017650661",
                "54295986294101972822852762588617473092",
                "55486358970535260111721862803837298368",
                "479395375871184399048480116120362544"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-57486-faedecba",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pupnp/pupnp/commit/280cff736ee0a2384d8a67011382e6fe76a51167",
        "target":  {
            "file":  "ixml/test/poc_ghsa_q54q.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-17T07:05:58Z"