CVE-2012-5964: Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in...

Security readout for executives and security teams

CVE-2012-5964 is a remote code execution risk in the Portable SDK for UPnP Devices, also known as libupnp. A malformed UPnP/SSDP UDP message with an overly long service type can overflow stack memory. Systems or devices embedding the vulnerable library may be exposed if UPnP traffic reaches them. Exposure is most likely in software, appliances, routers, or embedded devices that include libupnp or the former Intel UPnP SDK and process SSDP/UPnP UDP traffic. The bundle names vendor advisories but does not provide a complete affected-product inventory. Treat this as high priority where UPnP-capable devices are reachable from untrusted networks or sit on sensitive network segments. Prioritize internet-facing or perimeter-adjacent appliances first, then internal embedded devices that are difficult to patch. Mitigation focus: Inventory systems and devices using libupnp or the Portable SDK for UPnP Devices.; Apply vendor firmware or package updates that reference this CVE or related UPnP advisories.; Disable UPnP/SSDP where it is not required for business operation..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.