# CVE-2026-28525: SWUpdate integer underflow in multipart upload parser

Source: https://junglewise.ai/threats/cve-2026-28525-swupdate-integer-underflow-in-multipart-upload-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-23. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-28525 · Severity: medium · CVSS 6.8 · Published 2026-04-23

SWUpdate is an open-source framework used to manage software updates on embedded Linux systems. A flaw in how it handles file uploads allows an unauthenticated attacker to crash the update service by sending a specially crafted web request. This can prevent the device from receiving critical software updates and disrupt normal operations.

## Quick answers

**Is CVE-2026-28525 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28525 being exploited in the wild.

**How severe is CVE-2026-28525?** Medium severity, with a CVSS score of 6.8, published 23 April 2026.

**Which products and versions are affected?** sbabic SWUpdate <= 2025.12.

**Is there a fix for CVE-2026-28525?** A patch was published on 2026-04-23: Fixed in commit beee2dc0feef1cfe84f1aa6fc980e104b2e47a74 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28525 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-28525?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow exists in the mongoose_multipart.c component of SWUpdate within the mg_http_multipart_continue_wait_for_chunk() function. The vulnerability is caused by a logic mismatch between a guard condition and a subsequent subtraction operation when calculating data length; specifically, the guard checks for a length of +6 while the subtraction uses +8. When the buffer length falls between these values, a size_t underflow occurs, leading to an out-of-bounds heap read. An attacker can exploit this by sending a crafted HTTP POST request to the /upload endpoint with a malformed multipart boundary and specific TCP timing to trigger a denial of service. A patch is available in commit beee2dc.

## Affected products

- sbabic SWUpdate <= 2025.12

## Timeline

- 2026-04-23: disclosed
- 2026-04-23: advisory
- 2026-04-23: patched: Fixed in commit beee2dc0feef1cfe84f1aa6fc980e104b2e47a74

## References

- [https://github.com/sbabic/swupdate/commit/beee2dc0feef1cfe84f1aa6fc980e104b2e47a74](https://github.com/sbabic/swupdate/commit/beee2dc0feef1cfe84f1aa6fc980e104b2e47a74)
- [https://www.vulncheck.com/advisories/swupdate-integer-underflow-in-multipart-upload-parser](https://www.vulncheck.com/advisories/swupdate-integer-underflow-in-multipart-upload-parser)