CVE-2026-24798: DagorEngine Buffer Overflow Vulnerability

CVE-2026-24798 Overview

CVE-2026-24798 is a memory corruption vulnerability affecting GaijinEntertainment DagorEngine through release dagor_2025_01_15. The flaw resides in the bundled miniupnpc third-party library, specifically within the upnpreplyparse.C source file located under prog/3rdPartyLibs/miniupnpc. The vulnerability is classified as Improper Restriction of Operations within the Bounds of a Memory Buffer [CWE-119]. An unauthenticated attacker can reach the vulnerable parser over the network, since UPnP responses are processed without prior authentication. Successful exploitation can compromise integrity and availability of the host process and impact downstream subsystems that consume parsed UPnP data.

Critical Impact
Network-reachable memory corruption in the UPnP reply parser enables unauthenticated attackers to corrupt process memory and degrade or hijack game engine subsystems.

Affected Products

GaijinEntertainment DagorEngine through dagor_2025_01_15
Bundled prog/3rdPartyLibs/miniupnpc module
Applications and games built on affected DagorEngine releases

Discovery Timeline

2026-01-27 - CVE-2026-24798 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-24798

Vulnerability Analysis

The vulnerability exists in upnpreplyparse.C, the XML reply parser shipped with the miniupnpc library inside DagorEngine. The parser handles SOAP responses returned by Universal Plug and Play (UPnP) Internet Gateway Devices. Improper bounds checking during parsing of attacker-controlled response data allows operations to read or write outside the intended buffer. Because the parser processes data received over the network, no local access or user interaction is required to reach the vulnerable code path.

The condition is tracked under CWE-119, covering improper restriction of operations within the bounds of a memory buffer. Impact extends beyond the parser itself, because corrupted state propagates to subsequent UPnP control logic and connected subsystems.

Root Cause

The root cause is insufficient validation of length and offset values when copying or indexing fields from parsed UPnP reply payloads. The miniupnpc parser trusts size hints derived from untrusted XML input, leading to out-of-bounds memory access in upnpreplyparse.C. The upstream patch referenced in GaijinEntertainment DagorEngine Pull Request #136 addresses the bounds handling in this module.

Attack Vector

An attacker capable of responding to UPnP SOAP requests issued by an affected DagorEngine client can deliver a crafted XML reply. This includes attackers on the same local network, attackers operating a hostile gateway, or attackers performing on-path interception of UPnP traffic. The vulnerable client parses the malicious response, triggering memory corruption inside the game or server process. No credentials or user interaction are required.

No public proof-of-concept exploit is available. Technical details are described in the referenced pull request rather than in synthetic exploitation code.

Detection Methods for CVE-2026-24798

Indicators of Compromise

Unexpected crashes or memory access violations in processes built on DagorEngine immediately following UPnP discovery or port-mapping activity.
Outbound SSDP (UDP/1900) and SOAP traffic from game clients to unexpected or non-gateway hosts on the local network.
Anomalous child process creation or code execution originating from DagorEngine-based binaries shortly after network initialization.

Detection Strategies

Inspect network telemetry for malformed UPnP SOAP replies, including responses with oversized element values or inconsistent length fields.
Hunt for DagorEngine binaries that load miniupnpc components and correlate process telemetry with UPnP traffic patterns.
Apply CWE-119 focused detections that flag heap or stack corruption signatures inside game client and dedicated server processes.

Monitoring Recommendations

Log and review SSDP and UPnP control-point traffic on segments that host gaming workloads or DagorEngine-based services.
Monitor for crash dumps and Watson or coredump events from affected binaries and triage them for memory corruption artifacts.
Track software inventory for DagorEngine versions at or below dagor_2025_01_15 and prioritize them for patch validation.

How to Mitigate CVE-2026-24798

Immediate Actions Required

Update DagorEngine to a release that incorporates the fix from DagorEngine Pull Request #136.
Rebuild and redistribute any downstream products that statically link the affected miniupnpc module.
Restrict UPnP traffic on untrusted networks and disable UPnP client functionality where it is not required.

Patch Information

The fix is provided through the upstream repository in GaijinEntertainment DagorEngine Pull Request #136, which corrects the bounds handling in prog/3rdPartyLibs/miniupnpc/upnpreplyparse.C. Vendors integrating DagorEngine must merge the patched sources and reissue affected binaries to consumers.

Workarounds

Disable UPnP-based NAT traversal in DagorEngine-derived applications when configurable, removing the code path that invokes upnpreplyparse.
Block outbound SSDP discovery (UDP/1900) and UPnP SOAP control traffic at the host or network firewall to prevent reception of crafted replies.
Segment gaming hosts onto trusted networks so that only legitimate Internet Gateway Devices can answer UPnP requests.

bash

# Configuration example: block UPnP discovery and control traffic on Linux hosts
sudo iptables -A OUTPUT -p udp --dport 1900 -j DROP
sudo iptables -A INPUT  -p udp --sport 1900 -j DROP
sudo iptables -A OUTPUT -p tcp --dport 2869 -j DROP
sudo iptables -A OUTPUT -p tcp --dport 5000 -j DROP