lwIP (Lightweight IP)
CISA warns lwIP 2.0.1–2.2.1 has a double-free that can crash devices or enable code execution.
46
Vulnerability4 · 2 reads
CVE-2026-91018
Double Free Vulnerability in lwIP System
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The CVE-2026-91018 vulnerability in lwIP exposes a double free flaw, which can cause system crashes, denial of service, memory corruption, or allow code execution on the victim system. The vulnerability has no known public exploit and no CISA KEV classification, indicating it is currently under active monitoring but not actively exploited.
What to do: Upgrade to the latest stable version of lwIP to patch the double free vulnerability. Implement memory sanitization and memory allocation validation checks. Monitor for abnormal system behavior and verify no unpatched installations remain.
| Product | Affected |
|---|---|
| lwIP (Lightweight IP) | No specific version range provided |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
- Weakness
- CWE-415
- Vector
- CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X