CVE-2026-107159
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local
CVSS
6.5
Medium
EPSS
0.2%
p14
KEV
—
Exploit Today
4
0-100
Published: Oct 7, 2026 · Last modified: Oct 7, 2026 · CWE-369
0.2%EPSS · 30 days0.2%
2026-10-082026-10-12
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.
- github.comhttps://github.com/miniupnp/miniupnp
- github.comhttps://github.com/miniupnp/miniupnp/blob/miniupnpd_2_3_11/miniupnpd/minissdp.c#L1143-L1158
- github.comhttps://github.com/miniupnp/miniupnp/blob/miniupnpd_2_3_11/miniupnpd/minissdp.c#L1281
- github.comhttps://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a
- www.vulncheck.comhttps://www.vulncheck.com/advisories/miniupnpd-through-2.3.11-divide-by-zero-dos-via-ssdp-m-search-mx-header
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1052504.3 MED23.0%
——7A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decoder.c of the component Microsoft IMA Decoder. Such manipulation leads to divide by zero. The attack can be executed remotely.7dCVE-2026-1018873.5 LOW3.9%
——1BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread) that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.12dCVE-2026-935893.7 LOW19.4%
——6ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56.21dCVE-2026-928814.3 MED46.9%
——14A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory of the file src/meta/awb.c of the component AWB parser. Such manipulation leads to divide by zero. The attack can be executed remotely. The name of the patch is ae37662ad626254ddd96ad69ac263792d7a92024. A patch should be applied to remediate this issue.20dCVE-2026-919557.5 HIG45.7%
——14FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-by-zero or assertion failures in multifragment update capability calculations, terminating the server process.19dCVE-2026-15417—2.0%
——1In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash.33d