Read the docs
TI-2026-76190 Aliases CVE-2026-112062GHSA-7m6v-7jf3-5x4h

Stack out-of-bounds write in lwIP mDNS response handler

Priority MEDIUM 60CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

lwIP through 2.2.1 contains a stack-based buffer overflow (CWE-121) in the mDNS response handler mdns_handle_response. An adjacent attacker on the local link, without privileges or user interaction, can send crafted mDNS responses during a service search to corrupt stack memory and crash the device.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00356 29th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lwIPlwIPup to 2.2.1—No fix listedCNA
  • lwIP VendorlwIP Affected up to 2.2.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for lwIP.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-112062
  2. 2026-10-18 Alias added: GHSA-7m6v-7jf3-5x4h
  3. 2026-10-19 Priority changed: MEDIUM → LOW
  4. 2026-10-20 CISA SSVC decision points changed
  5. 2026-10-20 Priority changed: LOW → MEDIUM
  6. 2026-10-21 Affected versions changed · Red Hat
  7. 2026-10-21 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 1

  • TI-2026-59484 Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application CVSS 4.0CRITICAL 9.3
  • TI-2026-61856 Double Free in lwIP (lightweight IP) CVSS 4.0HIGH 8.7
  • TI-2026-82411 Out-of-bounds read in lwIP SNMP agent leaks adjacent memory CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences