lwIP vulnerabilities

🔔 Create alert RSS

Published CVEs affecting lwIP products: 2 record(s), with severity, exploitation and fixes.

TCP/IP Stack MQTT 1 lwIP API 1

Exploited only (KEV) →

CVE-2026-91018 High · 8.8 CWE-415 Sep 22, 2026

Double Free in lwIP (lightweight IP)

lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.

CVE-2026-87121 Critical · 9.8 CWE-787 Sep 22, 2026

Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application

lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.