CVE-2026-119053
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
lwIP versions 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() where copies are bounded by pbuf->len instead of remaining bytes. A remote unauthenticated attacker knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
Risk Assessment
Device memory data may leak, potentially exposing sensitive information or facilitating further attacks. The risk affects devices with the SNMP agent enabled in the vulnerable lwIP version.
Recommendation
Update lwIP to a version later than 2.2.1 or disable the SNMP agent if not needed. Restrict SNMP access and change default read community strings.
Other vulnerabilities in lwIP
See all- CVE-2026-15340Critical
The lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.
- CVE-2026-87121Critical
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.
- CVE-2026-8836Critical
A vulnerability was found in lwIP up to 2.2.1 in the snmp_parse_inbound_frame function of src/apps/snmp/snmp_msg.c in the SNMPv3 USM handler. Manipulating the msgAuthenticationParameters argument results in a stack-based buffer overflow. The attack can be initiated remotely. A patch named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c is available.
- CVE-2026-112062Medium
lwIP through 2.2.1 contains a stack out-of-bounds write in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6.
- CVE-2026-91018High
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
Original NVD description (English source)
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS