CVE-2026-8836
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A vulnerability was found in lwIP up to 2.2.1 in the snmp_parse_inbound_frame function of src/apps/snmp/snmp_msg.c in the SNMPv3 USM handler. Manipulating the msgAuthenticationParameters argument results in a stack-based buffer overflow. The attack can be initiated remotely. A patch named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c is available.
Risk Assessment
The vulnerability may allow a remote attacker to execute code or cause a denial of service, potentially compromising system integrity and availability.
Recommendation
It is recommended to immediately apply the available patch (0c957ec03054eb6c8205e9c9d1d05d90ada3898c) to remediate the vulnerability.
Other vulnerabilities in lwIP
See all- CVE-2026-15340Critical
The lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.
- CVE-2026-87121Critical
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.
- CVE-2026-119053Medium
lwIP versions 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() where copies are bounded by pbuf->len instead of remaining bytes. A remote unauthenticated attacker knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
- CVE-2026-112062Medium
lwIP through 2.2.1 contains a stack out-of-bounds write in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6.
- CVE-2026-91018High
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
Original NVD description (English source)
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue. Two separate issue reports were submitted to the project. Their processing was merged as a duplicate.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS