CVE-2026-112062
lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.
| CWE | CWE-121 |
| Vendor | lwip |
| Product | lwip |
| Published | Oct 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for lwip lwip
Be the first to know when new medium vulnerabilities affecting lwip lwip are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Affected Versions
lwIP / lwIP
0 ≤ 2.2.1
References
hackmd.io: https://hackmd.io/@haindpwn/lwip-mdns-search-result-domain-oob-write github.com: https://github.com/lwip-tcpip/lwip/commit/ab2f69c7d8980c01cdd67ed4b23ac61118ed0205 github.com: https://github.com/lwip-tcpip/lwip/blob/STABLE-2_2_1_RELEASE/src/apps/mdns/mdns.c vulncheck.com: https://www.vulncheck.com/advisories/lwip-through-2.2.1-stack-out-of-bounds-write-via-mdns-search-response-handler
Credits
HaiND from the Post and Telecommunication Institute of Technology