CVE-2026-87121

The lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

A vulnerability was found in lwIP up to 2.2.1 in the snmp_parse_inbound_frame function of src/apps/snmp/snmp_msg.c in the SNMPv3 USM handler. Manipulating the msgAuthenticationParameters argument results in a stack-based buffer overflow. The attack can be initiated remotely. A patch named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c is available.

lwIP versions 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() where copies are bounded by pbuf->len instead of remaining bytes. A remote unauthenticated attacker knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.

lwIP through 2.2.1 contains a stack out-of-bounds write in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6.

lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.