lwIP (Lightweight IP)
CISA warns lwIP 2.0.1–2.2.1 has a double-free that can crash devices or enable code execution.
CISA ICS advisory ICSA-26-265-02 covers CVE-2026-91018, a double-free (CWE-415) in lwIP API versions 2.0.1 through 2.2.1. Successful exploitation could crash the system, cause a denial of service or memory corruption, or lead to code execution. CVSS v3.1 is 8.8 High and CVSS v4.0 is 8.7 High, with an adjacent-network vector; CISA says it is not remotely exploitable. Eric Evenchick of Tetrel Security reported it, and CISA says no known public exploitation has been reported.
- CVE-2026-91018 is a double-free in lwIP API 2.0.1 through 2.2.1.
- CVSS v3.1 is 8.8 High; the flaw is adjacent-network, not remote.
- Impact can include crash, denial of service, memory corruption, or code execution.
- CISA reports no known public exploitation of this vulnerability.
- CVEs
- CVE-2026-91018
- Vendors
- lwIP
- Products
- lwIP
- Organizations
- CISATetrel Security
- Countries
- Sweden
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91018 | Double Free Vulnerability in lwIP System | 8.7 | — |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could result in a system crash, a DoS, or memory corruption, which could lead to code execution on the victim system. The following versions of lwIP (Lightweight IP) are affected: API >=2. 0.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.