Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-87121: lwIP MQTT client can be tricked to run malicious code
CVE-2026-87121 · published 21 days ago
Summary
The MQTT component of the lwIP networking library can write data outside its intended memory area, which could let an attacker take control of the device. This could lead to the device performing unwanted actions or exposing data. Update the lwIP library to a version that includes the fix or apply the vendor’s security patch as soon as possible.
What to do
- Update debian lwip to version 2.2.1+dfsg1-8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | lwip | tcp/ip stack mqtt | <= 2.2.1 |
| Ubuntu:Pro:20.04:LTS | canonical | lwip | All versions |
| Debian:12 | debian | lwip | All versions |
| Debian:14 | debian | lwip |
< 2.2.1+dfsg1-8 Fix: upgrade to 2.2.1+dfsg1-8
|
Original advisory text
Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.
References
- https://savannah.nongnu.org/projects/lwip
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-01
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-26...
- https://ubuntu.com/security/CVE-2026-87121 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-87121 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-87121 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.9
Critical
Type
CWE-787Out-of-bounds Write
Timeline
Published22 Sep 2026
Updated14 Oct 2026
First seen22 Sep 2026
Sources
CVE-2026-87121 · NVD
CVE-2026-87121 · MITRE
UBUNTU-CVE-2026-87121 · OSV
DEBIAN-CVE-2026-87121 · OSV
Track software like this
Free during beta