Out-of-Bounds Read Vulnerability in lwIP SNMP Agent by C/C++

CVE-2026-119053

What is CVE-2026-119053?

lwIP versions 2.0.0 through 2.2.1, when built with the SNMP agent, are susceptible to an out-of-bounds read vulnerability. The flaw exists in the snmp_pbuf_stream_writeto() function, where the bounds check is incorrectly conducted using pbuf->len rather than the available bytes. This oversight allows remote, unauthenticated attackers who know the read community to exploit the vulnerability by sending fragmented SNMP requests. Consequently, they can receive adjacent data from the receive buffer or memory pool in the echoed responses, potentially exposing sensitive information and leading to further attacks.

References