CVE-2026-15340

The lightweight IP (lwIP) open-source TCP/IP stack contains a buffer overflow in its SMTP client component, which fails to validate the size of inputs before copying them into fixed-size buffers. An attacker who can control data processed by the SMTP client (such as server responses or crafted message content) could overwrite memory, potentially leading to code execution or a crash on the embedded device. The flaw affects any embedded product or firmware that enables and uses lwIP's SMTP client functionality, which is common in IoT and industrial devices. The CVSS v4.0 score is 9.3 (critical), with network attack vector, no privileges or user interaction required. No public proof of concept or known in-the-wild exploitation has been reported, and the issue is not on the CISA KEV list.

What to do: Check whether your embedded devices or firmware builds enable lwIP's SMTP client (LWIP_SMTP option); if it is unused, disable it in the build configuration. If it is required, apply upstream lwIP patches or vendor firmware updates that add input size validation, and restrict SMTP traffic to trusted servers. Monitor ICS-CERT advisories for vendor-specific advisories derived from this CVE.