What’s Vulnerable › Vulnerabilities

CVE-2026-112062: lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-18 · updated 2026-10-19
• Weakness: CWE-121

Description

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.

Affected products

• lwIP: through 2.2.1

References

• https://github.com/lwip-tcpip/lwip/blob/STABLE-2_2_1_RELEASE/src/apps/mdns/mdns.c
• https://github.com/lwip-tcpip/lwip/commit/ab2f69c7d8980c01cdd67ed4b23ac61118ed0205
• https://hackmd.io/@haindpwn/lwip-mdns-search-result-domain-oob-write
• https://www.vulncheck.com/advisories/lwip-through-2.2.1-stack-out-of-bounds-write-via-mdns-search-response-handler
• https://hackmd.io/@haindpwn/cve-2026-112062-lwip-mdns-search-result-domain-oob-write

Get alerted when CVE-2026-112062 or the next vulnerability affects your stack