Quick answers
- Is CVE-2026-28525 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-28525 being exploited in the wild.
- How severe is CVE-2026-28525?
- Medium severity, with a CVSS score of 6.8, published 23 April 2026.
- Which products and versions are affected?
- sbabic SWUpdate <= 2025.12.
- Is there a fix for CVE-2026-28525?
- A patch was published on 2026-04-23: Fixed in commit beee2dc0feef1cfe84f1aa6fc980e104b2e47a74 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-28525 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-28525?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer underflow exists in the mongoose_multipart.c component of SWUpdate within the mg_http_multipart_continue_wait_for_chunk() function. The vulnerability is caused by a logic mismatch between a guard condition and a subsequent subtraction operation when calculating data length; specifically, the guard checks for a length of +6 while the subtraction uses +8. When the buffer length falls between these values, a size_t underflow occurs, leading to an out-of-bounds heap read. An attacker can exploit this by sending a crafted HTTP POST request to the /upload endpoint with a malformed multipart boundary and specific TCP timing to trigger a denial of service. A patch is available in commit beee2dc.
Affected products
- sbabic SWUpdate <= 2025.12
Timeline
- 2026-04-23: disclosed
- 2026-04-23: advisory
- 2026-04-23: patched: Fixed in commit beee2dc0feef1cfe84f1aa6fc980e104b2e47a74