lwIP TCP/IP Stack MQTT Client Application
CISA warns lwIP MQTT client versions 2.0.1 through 2.2.1 have critical CVE-2026-87121.
CISA published ICSA-26-265-01 for an out-of-bounds write in the lwIP MQTT client, CVE-2026-87121, affecting versions 2.0.1 through 2.2.1. CVSS v3.1 is 9.8 and CVSS v4.0 is 9.3; successful exploitation could allow full code execution. The stack is deployed across multiple critical infrastructure sectors worldwide. CISA says no known public exploitation has been reported.
- CVE-2026-87121 is an out-of-bounds write in lwIP's MQTT client.
- Affected versions are 2.0.1 through 2.2.1; CVSS v3.1 score is 9.8.
- Exploitation could yield full code execution without authentication.
- CISA reports no known public exploitation at this time.
- CVEs
- CVE-2026-87121
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87121 | lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device | 9.3 | — |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain full code execution on the device. The following versions of lwIP TCP/IP Stack MQTT Client Application are affected: MQTT Client Application >=2. 0.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.