CVE-2026-107159: MiniUPnPd Divide-by-Zero DoS Vulnerability

CVE-2026-107159 Overview

CVE-2026-107159 is a divide-by-zero vulnerability in MiniUPnPd through version 2.3.11 when built with the --strict option. The flaw exists in the ProcessSSDPData() function within minissdp.c. Unauthenticated attackers on the local network can send a single multicast M-SEARCH datagram with MX: 0 and a known ST value to port 1900. The malformed packet triggers a SIGFPE signal and crashes the daemon. The resulting denial of service disables UPnP Internet Gateway Device (IGD) functionality. The vulnerability is tracked under [CWE-369: Divide By Zero].

Critical Impact
A single adjacent-network SSDP packet terminates the MiniUPnPd daemon, denying UPnP IGD service to all clients until the process restarts.

Affected Products

MiniUPnPd versions through 2.3.11
Builds compiled with the --strict option
Routers, gateways, and embedded devices shipping MiniUPnPd with strict mode enabled

Discovery Timeline

2026-10-07 - CVE CVE-2026-107159 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-107159

Vulnerability Analysis

MiniUPnPd implements the Simple Service Discovery Protocol (SSDP) to advertise and respond to UPnP service queries. The ProcessSSDPData() function parses incoming M-SEARCH datagrams received on multicast port 1900. The parser reads the MX header, which specifies the maximum wait time a responder should use to randomize its reply. When built with --strict, the implementation performs an arithmetic operation that uses the parsed MX value as a divisor. Supplying MX: 0 produces a divide-by-zero condition. The CPU raises SIGFPE, terminating the daemon process. UPnP IGD services such as automatic port mapping become unavailable until the service is manually restarted.

Root Cause

The root cause is insufficient validation of the MX header value in the M-SEARCH handler. The code accepted MX: 0 as a valid input and used it directly in a division operation. The upstream fix enforces a minimum accepted value of 1 for the MX header, rejecting zero before any arithmetic executes. The vulnerable code paths are located in miniupnpd/minissdp.c around lines 1143-1158 and line 1281 of the miniupnpd_2_3_11 tag.

Attack Vector

An attacker on the same local or adjacent network sends one UDP datagram to the multicast SSDP address on port 1900. The datagram contains a well-formed M-SEARCH request with a recognized ST (search target) value and the header MX: 0. No authentication, user interaction, or prior access is required. The daemon processes the packet, hits the division-by-zero path, and terminates. The attack requires adjacency to the SSDP multicast domain, as reflected in the CVSS attack vector.

/* vim: tabstop=4 shiftwidth=4 noexpandtab
 * MiniUPnP project
 * http://miniupnp.free.fr/ or https://miniupnp.tuxfamily.org/
- * (c) 2006-2025 Thomas Bernard
+ * (c) 2006-2026 Thomas Bernard
 * This software is subject to the conditions detailed
 * in the LICENCE file provided within the distribution */

Source: MiniUPnP commit 8f13b7a — the patch rejects MX: 0 and enforces the documented minimum of 1 before the division operation runs.

Detection Methods for CVE-2026-107159

Indicators of Compromise

Unexpected termination of the miniupnpd process accompanied by SIGFPE entries in system logs or core dumps.
Inbound SSDP M-SEARCH packets on UDP port 1900 containing the literal header MX: 0.
Loss of UPnP IGD port-mapping functionality on gateways while the host network remains otherwise reachable.

Detection Strategies

Inspect multicast SSDP traffic on 239.255.255.250:1900 for M-SEARCH requests where the MX header value is zero or non-numeric.
Monitor process supervisors (systemd, procd, inittab) for repeated restarts of miniupnpd without administrator action.
Correlate kernel audit messages for SIGFPE delivered to the miniupnpd process identifier.

Monitoring Recommendations

Alert on SSDP M-SEARCH volume anomalies originating from a single internal host.
Capture packet traces at the LAN boundary to retain evidence of malformed MX headers for forensic review.
Enable persistent crash reporting on embedded devices so that recurrent miniupnpd faults are escalated rather than silently restarted.

How to Mitigate CVE-2026-107159

Immediate Actions Required

Upgrade MiniUPnPd to the version containing commit 8f13b7a5843f5270db684099c0a083f98869636a or later.
If upgrade is not immediately possible, rebuild MiniUPnPd without the --strict option to avoid the vulnerable code path.
Restrict SSDP multicast traffic at the LAN switch or firewall to trusted hosts only.

Patch Information

The upstream fix is published in the MiniUPnP repository. The commit titled "minissdp.c: MX: 0 is invalid as well. 1 is the minimum accepted" validates the MX header before it is used in arithmetic. Review the full change set at the MiniUPnP commit 8f13b7a and refer to the VulnCheck advisory on MiniUPnPd for additional context. Vendors shipping MiniUPnPd in router firmware should rebuild images against a patched tree.

Workarounds

Disable UPnP IGD on gateways where the service is not required by downstream clients.
Deploy host-based filters that drop UDP packets destined for port 1900 containing the exact byte sequence for MX: 0.
Configure a process supervisor to automatically restart miniupnpd so that transient crashes do not produce prolonged outages.

bash

# Example iptables rule to drop SSDP M-SEARCH packets containing MX: 0
iptables -A INPUT -p udp --dport 1900 \
  -m string --algo bm --string "MX: 0" \
  -j DROP