Stack Out-of-Bounds Write in lwIP Affects Multiple Versions
CVE-2026-112062

6MEDIUM

Key Information:

Vendor

Lwip

Status
Lwip
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112062?

lwIP versions up to and including 2.2.1 are susceptible to a stack out-of-bounds write vulnerability located in the mDNS response handler. This flaw allows local attackers to corrupt the device's stack memory by sending specially crafted mDNS responses, using invalid domain names. Attackers can exploit this vulnerability by broadcasting multicast Pointer (PTR) answers with oversized RDLENGTH or SRV answers with insufficient RDLENGTH, causing a buffer overflow of the 256-byte stack space and potentially leading to device crashes.

Affected Version(s)

lwIP 0 <= 2.2.1

References

https://hackmd.io/@haindpwn/lwip-mdns-search-result-domai...
third-party-advisory
https://github.com/lwip-tcpip/lwip/commit/ab2f69c7d8980c0...
patch
https://github.com/lwip-tcpip/lwip/blob/STABLE-2_2_1_RELE...
technical-description

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.