Use-after-free in PUPnP - #VU161877
Published: November 8, 2026
Vulnerability identifier: #VU161877
CSH Severity: Medium
CVSS v4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-416
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated network-adjacent attacker to crash a PUPnP control-point application through heap use-after-free.
The vulnerability exists due to queued SSDP search-result callbacks retaining application cookies after client unregistration or search timeout, when applications may free them. An unauthenticated network-adjacent attacker can observe an outstanding search and flood matching replies during callback delays, causing queued callbacks to access cookies freed by the application.
Affected software
PUPnP
Remediation
Install security update from vendor's website.
PUPnP - update to 22.2.1