CVE-2026-112062 lwIP CVE debrief

Who should care

Defenders responsible for network devices and systems using lwIP should assess exposure and prioritize patching. Network administrators and security teams should monitor local network traffic for suspicious mDNS responses.

Why it matters

CVE-2026-112062 is a stack out-of-bounds write vulnerability in lwIP that allows adjacent attackers to corrupt stack memory. Defenders should prioritize verifying and patching affected installations, especially in local network environments.

• Corruption of stack memory by adjacent attackers
• Potential device crashes or instability
• Need for verification of affected versions and patching
• Importance of monitoring local network traffic for suspicious activity

Technical summary

The vulnerability is caused by a stack out-of-bounds write in the mdns_handle_response function, which can be triggered by sending mDNS responses with invalid domain names. The vulnerability affects lwIP through version 2.2.1 and has a CVSS score of 6. It allows adjacent attackers to corrupt stack memory. Defenders should prioritize verifying and patching affected lwIP installations, especially in local network environments where adjacent attackers could exploit this vulnerability. The vulnerability can be mitigated by verifying affected versions, patching, and monitoring local network traffic for suspicious activity.

Defensive priority

Defenders should prioritize verifying and patching affected lwIP installations, especially in local network environments where adjacent attackers could exploit this vulnerability.

Recommended defensive actions

• Verify and patch affected lwIP installations
• Monitor local network traffic for suspicious mDNS responses
• Implement network segmentation to limit adjacent attacker access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by a stack out-of-bounds write in the mdns_handle_response function, which can be triggered by sending mDNS responses with invalid domain names. The vulnerability affects lwIP through version 2.2.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.