Savannah lwIP SMTP client
CISA reports a critical buffer overflow in Savannah lwIP SMTP client 2.2.1 that may allow remote code execution.
CISA advisory ICSA-26-279-02 covers CVE-2026-15340 in Savannah lwIP SMTP client 2.2.1. The client fails to check input size, a classic buffer overflow (CWE-120) scored CVSS 3.1 9.8 and CVSS 4.0 9.3, which could crash the device or allow remote code execution. Researcher xchglabs reported it; the fix is patch_125_smtp_txbuf.diff (git commit 614420f). The component is used in energy and water systems worldwide, and the advisory does not report active exploitation.
- CVE-2026-15340 is an unauthenticated buffer overflow scored CVSS 9.8.
- lwIP SMTP client 2.2.1 may crash or allow remote code execution.
- Fix is patch_125_smtp_txbuf.diff, commit 614420f.
- Relevant to energy and water and wastewater systems worldwide.
- CVEs
- CVE-2026-15340
- Vendors
- Savannah
- Products
- lwIP SMTP client
- Organizations
- CISA
- Countries
- Sweden
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-15340 | Buffer Overflow in lwIP SMTP Client from Unchecked Input Sizes | 9.3 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 614420f82c8729d070e01464c0dddb3c9525c772 | _txbuf.diff . This is available as available as git commit (614420f82c8729d070e01464c0dddb3c9525c772) Additional Metrics Relevant CWE: CWE-120 Buffer Copy witho |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. The following versions of Savannah lwIP SMTP client are affected: lwIP SMTP client 2. 2.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.