Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-119053

lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()

lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Lwip Lwip Project
Products
Lwip Lwip
CVE-2026-112062

lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Lwip Lwip Project
Products
Lwip Lwip
CVE-2026-91018

Double Free in lwIP (lightweight IP)

lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lwip
Products
Lwip
CVE-2026-87121

Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application

lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Lwip
Products
Tcp/ip Stack Mqtt
CVE-2026-8836

lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow

A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue. Two separate issue reports were submitted to the project. Their processing was merged as a duplicate.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed
Vendors
Lwip Lwip-tcpip
Products
Lwip Lwip