CVE-2026-112062: lwip Stack-based Buffer Overflow

Vulnerability summary

CVE-2026-112062 is a medium (CVSS 6.0) Stack-based Buffer Overflow vulnerability in lwip. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-10-2026
   PublishedVulnerability first disclosed.
2. 19-10-2026
   Last modifiedVulnerability information updated.

Description

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).