CVE-2016-8863
Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP...
CVE-2016-8863 is a critical vulnerability (CVSS 9.8) in Libupnp Project Libupnp, published December 16, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.56%, the 95th percentile. Fixed in libupnp 1:1.6.17-1.2+deb7u2.
Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.
- Record
CVE-2016-8863- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.
- Record
CVE-2016-8863- Updated
- 2026-11-02
EUVDEUVD-2016-9688 No score
Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.
- Record
EUVD-2016-9688- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4cjm-5fqc-2f6p
Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP...
Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.
- Record
GHSA-4cjm-5fqc-2f6p- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.
- Record
CVE-2016-8863- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-8863
Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.
- Record
UBUNTU-CVE-2016-8863- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0002 No score
Updated libupnp packages fix security vulnerability
Scott Tenaglia discovered a heap buffer overflow vulnerability, that can lead to denial of service or remote code execution (CVE-2016-8863).
- Record
MGASA-2017-0002- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11006-1 No score
libixml11-1.14.10-1.2 on GA media
These are all security issues fixed in the libixml11-1.14.10-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11006-1- Updated
- 2026-11-02
OSVUSN-4794-1 No score
libupnp vulnerabilities
Matthew Garrett discovered that libupnp mishandled POST requests by default. An attacker could use this vulnerability to write files to arbitrary locations in the victim's filesystem, possibly as root. (CVE-2016-6255)
It was discovered that libupnp mishandled certain input. A remote attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary code. (CVE-2016-8863)
- Record
USN-4794-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libupnpDebian:7 |
before 1:1.6.17-1.2+deb7u2, plus listed versions 1:1.6.17-1.21:1.6.17-1.2+deb7u1 |
1:1.6.17-1.2+deb7u2 |
libupnp4Debian:7 |
before 1.8.0~svn20100507-1.2+deb7u1, plus listed versions 1.8.0~svn20100507-1.2 |
1.8.0~svn20100507-1.2+deb7u1 |
libupnpDebian:8 |
before 1:1.6.19+git20141001-1+deb8u1, plus listed versions 1:1.6.19+git20141001-1 |
1:1.6.19+git20141001-1+deb8u1 |
libupnpMageia:5 |
before 1.6.19-4.2.mga5 | 1.6.19-4.2.mga5 |
libupnpUbuntu:14.04:LTS |
before 1:1.6.17-1.2+deb7u2build0.14.04.1, plus listed versions 1:1.6.17-1.21:1.6.17-1.2+deb7u1build0.14.04.1 |
1:1.6.17-1.2+deb7u2build0.14.04.1 |
libupnp4Ubuntu:14.04:LTS |
before 1.8.0~svn20100507-1.2+deb7u1build0.14.04.1, plus listed versions 1.8.0~svn20100507-1.2 |
1.8.0~svn20100507-1.2+deb7u1build0.14.04.1 |
libupnpUbuntu:Pro:16.04:LTS |
before 1:1.6.19+git20160116-1ubuntu0.1~esm1, plus listed versions 1:1.6.19+git20141001-11:1.6.19+git20141001-1ubuntu11:1.6.19+git20160116-1 |
1:1.6.19+git20160116-1ubuntu0.1~esm1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | mephi42/CVE-2016-8863 | 2020-12-24 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
sourceforge.net/p/pupnp/bugs/133
security.gentoo.org/glsa/201701-52
debian.org/security/2016/dsa-3736
tenable.com/security/research/tra-2017-10
securityfocus.com/bid/92849
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-8863
github.com/advisories/GHSA-4cjm-5fqc-2f6p
advisories.mageia.org/MGASA-2017-0002.html
bugs.mageia.org/show_bug.cgi?id=19961
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8863
ubuntu.com/security/CVE-2016-8863
cve.org/CVERecord?id=CVE-2016-8863
suse.com/security/cve/CVE-2016-6255