Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-112062: lwIP up to 2.2.1 can crash from crafted mDNS traffic

CVE-2026-112062 · published 17 days ago

Summary

The lwIP networking library version 2.2.1 and earlier, as used in Debian and Canonical packages, can be forced to write beyond its memory when it receives specially crafted mDNS (multicast DNS) replies. An attacker on the same local network could cause the device to stop working or restart. Upgrade to a newer lwIP release or apply the vendor’s patch, and limit mDNS traffic to trusted devices.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	lwip	All versions
–	lwip	lwip	<= 2.2.1
Ubuntu:Pro:20.04:LTS	canonical	lwip	All versions

Original advisory text

lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.

References

https://www.vulncheck.com/advisories/lwip-through-2.2.1-stack-out-of-bounds-writ... Vendor Advisory
https://github.com/lwip-tcpip/lwip/commit/ab2f69c7d8980c01cdd67ed4b23ac61118ed02... Patch
https://github.com/lwip-tcpip/lwip/blob/STABLE-2_2_1_RELEASE/src/apps/mdns/mdns.... Third Party Advisory
https://hackmd.io/@haindpwn/lwip-mdns-search-result-domain-oob-write Vendor Advisory
https://hackmd.io/@haindpwn/cve-2026-112062-lwip-mdns-search-result-domain-oob-w... Exploit
https://security-tracker.debian.org/tracker/CVE-2026-112062 Vendor Advisory
https://git.savannah.nongnu.org/git/lwip.git Product
https://savannah.nongnu.org/projects/lwip/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-1120... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-112062 Vendor Advisory
https://ubuntu.com/security/CVE-2026-112062 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-112062 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

8.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-121Stack-based Buffer Overflow

Timeline

Published18 Oct 2026

Updated4 Nov 2026

First seen18 Oct 2026

Sources

CVE-2026-112062 · NVD

DEBIAN-CVE-2026-112062 · OSV

CVE-2026-112062 · OSV

CVE-2026-112062 · MITRE

UBUNTU-CVE-2026-112062 · OSV

Track software like this

Free during beta