CVE-2026-112062
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
lwIP through 2.2.1 contains a stack out-of-bounds write in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6.
Risk Assessment
An attacker on the same local network can overflow a 256-byte stack buffer and crash the device, potentially enabling a denial-of-service attack. The risk affects IoT devices and embedded systems using lwIP.
Recommendation
Upgrade lwIP to a version newer than 2.2.1 as soon as a fix is available. Until then, limit exposure of mDNS services to untrusted local networks.
Other vulnerabilities in lwIP
See all- CVE-2026-15340Critical
The lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.
- CVE-2026-87121Critical
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.
- CVE-2026-8836Critical
A vulnerability was found in lwIP up to 2.2.1 in the snmp_parse_inbound_frame function of src/apps/snmp/snmp_msg.c in the SNMPv3 USM handler. Manipulating the msgAuthenticationParameters argument results in a stack-based buffer overflow. The attack can be initiated remotely. A patch named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c is available.
- CVE-2026-119053Medium
lwIP versions 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() where copies are bounded by pbuf->len instead of remaining bytes. A remote unauthenticated attacker knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
- CVE-2026-91018High
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
Original NVD description (English source)
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS