CVE-2026-15340: Savannah lwIP SMTP Client Classic Buffer Overflow
The Savannah lwIP SMTP client does not check the size of its inputs, which can potentially lead to a classic buffer overflow (CWE-120). CISA's ICS advisory reports a CVSS base score of 9.8 (critical) for the affected version 2.2.1, and the record lists no fixed version. The vulnerability is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.
Overview
The Savannah lwIP SMTP client does not check the size of inputs, which potentially allows a buffer overflow classified as CWE-120 (Classic Buffer Overflow). The issue was reported through the CISA ICS advisory channel and is recorded in NVD with status Awaiting Analysis.
Impact
The record lists a CVSS base score of 9.8 (critical) with a network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. CISA SSVC data indicates the issue is automatable and has total technical impact. Actual consequences depend on how the affected component is deployed, which the record does not describe.
Affected products and versions
- Product: Savannah lwIP SMTP client
- Affected version listed: 2.2.1
- Fixed version: none listed in the record. The absence of a listed fix does not mean no fix exists, so check the vendor and the CISA advisory.
Exploitation status
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00598 with a percentile of 0.4798 as of 2026-10-23, and SSVC lists exploitation as none.
Remediation and mitigation
- Identify all deployments that include the Savannah lwIP SMTP client, especially version 2.2.1.
- Follow the vendor guidance and CISA advisory icsa-26-279-02 for updates or workarounds as they become available.
- Limit network exposure of devices running the SMTP client, restrict who can reach them, and segment OT networks.
- Track the record for an updated fixed version, since none is listed yet.
Detection guidance
- Monitor for unexpected restarts, crashes or abnormal behavior in devices that use the SMTP client.
- Review network logs for unusual SMTP sessions to or from affected devices.
- Keep an asset inventory that records library and firmware versions so affected units can be identified quickly.
Limitations of the available information
The record provides a short description, no fixed version, no vendor-specific technical details, and no exploit or patch references beyond the CISA advisory and its CSAF file. The CVSS scores come from CISA's ICS-CERT entry, and the record does not describe the exact vulnerable code path or any conditions required beyond the score metrics.
Frequently asked questions
What is the vulnerability in CVE-2026-15340?
The Savannah lwIP SMTP client does not check the size of its inputs, which potentially allows a buffer overflow classified as CWE-120.
Which version is listed as affected?
The record lists version 2.2.1 of the Savannah lwIP SMTP client as affected.
Is there a fixed version or known exploitation?
The record lists no fixed version, so the fix status is unknown. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.