Skip to content
NewA calmer, faster ZeroHour
StoryAdvisoryhigh

CISA Details Two lwIP Flaws in Versions 2.0.1–2.2.1

1 source · 2 articlesFirst reported Updated ()4 · 1 read
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA warned that lwIP 2.0.1–2.2.1 has an MQTT out-of-bounds write and an adjacent-network double-free, with no known exploitation.

On September 22, 2026, CISA published two ICS advisories on distinct flaws in lwIP versions 2.0.1 through 2.2.1. ICSA-26-265-01 covers CVE-2026-87121, an out-of-bounds write in the MQTT client scored CVSS v3.1 9.8 and CVSS v4.0 9.3; CISA says successful exploitation could allow unauthenticated full code execution, and notes the stack is used across multiple critical infrastructure sectors worldwide. ICSA-26-265-02 covers CVE-2026-91018, a double-free (CWE-415) in the lwIP API scored CVSS v3.1 8.8 High and CVSS v4.0 8.7 High. That flaw has an adjacent-network vector and is not remotely exploitable; impacts can include a crash, denial of service, memory corruption, or code execution. Eric Evenchick of Tetrel Security reported CVE-2026-91018. The advisories do not conflict; CISA says no known public exploitation has been reported for either issue.

Key facts
  • On 2026-09-22 CISA published ICSA-26-265-01 and ICSA-26-265-02 for lwIP versions 2.0.1 through 2.2.1.
  • CVE-2026-87121 is an out-of-bounds write in the lwIP MQTT client, scored CVSS v3.1 9.8 and CVSS v4.0 9.3, and CISA says exploitation could allow unauthenticated full code execution.
  • CVE-2026-91018 is a double-free (CWE-415) in the lwIP API, scored CVSS v3.1 8.8 High and CVSS v4.0 8.7 High, with an adjacent-network vector; CISA says it is not remotely exploitable.
  • Successful exploitation of CVE-2026-91018 could crash the system, cause denial of service or memory corruption, or lead to code execution.
  • Eric Evenchick of Tetrel Security reported CVE-2026-91018.
  • CISA says lwIP is deployed across multiple critical infrastructure sectors worldwide.
  • CISA reports no known public exploitation of either vulnerability.
Analyze CVE-2026-87121 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-87121CVE-2026-91018
Vendors
lwIP
Products
lwIP MQTT ClientlwIP TCP/IP StacklwIP
Organizations
CISAByteRayTetrel Security
Countries
Sweden

Coverage

oldest first · one row per article · UTC
  1. · Sep 22, 2026 CISA AdvisoriesFirst report

    lwIP (Lightweight IP)

    CISA warns lwIP 2.0.1–2.2.1 has a double-free that can crash devices or enable code execution.

  2. · Sep 22, 2026 CISA Advisories

    lwIP TCP/IP Stack MQTT Client Application

    CISA warns lwIP MQTT client versions 2.0.1 through 2.2.1 have critical CVE-2026-87121.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-87121
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device
9.3—
CVE-2026-91018
Double Free Vulnerability in lwIP System
8.7—