What’s Vulnerable › Vulnerabilities

CVE-2019-12106

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-05-15 · updated 2026-06-17
• Weakness: CWE-416

Description

The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability.

Affected products

• miniupnp project miniupnpd: 1.4, 1.5

References

• https://github.com/miniupnp/miniupnp/commit/cd506a67e174a45c6a202eff182a712955ed6d6f
• https://lists.debian.org/debian-lts-announce/2019/05/msg00037.html
• https://www.vdoo.com/blog/security-issues-discovered-in-miniupnp
• https://github.com/miniupnp/miniupnp/commit/cd506a67e174a45c6a202eff182a712955ed6d6f
• https://lists.debian.org/debian-lts-announce/2019/05/msg00037.html
• https://www.vdoo.com/blog/security-issues-discovered-in-miniupnp

Get alerted when CVE-2019-12106 or the next vulnerability affects your stack