CVE-2012-5965: Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in...

Security readout for executives and security teams

CVE-2012-5965 is a remote memory corruption flaw in the libupnp SSDP parser. A malformed UDP packet with an overly long DeviceType field can overflow a stack buffer and may allow arbitrary code execution. Business urgency depends on whether vulnerable UPnP components are still present in products, firmware, or internal systems. Exposure is most likely where vulnerable libupnp 1.3.1 code is embedded in networked products, firmware, appliances, or OS packages with SSDP/UPnP enabled. The supplied affected table does not enumerate vendor products, so confirm exposure through SBOMs, package inventories, firmware notices, and vendor advisories. Treat as high priority for legacy network devices and embedded products because the stated impact is remote code execution. Prioritize internet-adjacent or untrusted-network exposure first, then internal appliances where UPnP remains enabled. Mitigation focus: Identify systems, products, or firmware using libupnp 1.3.1.; Apply relevant vendor, OS distribution, or firmware updates.; Disable UPnP/SSDP where it is not required..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.