Medium severity · published Oct 18, 2026
CVE-2026-112062
lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
5.9
CVSS
0.4%
EPSS
No
On KEV
Description
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LW
lwIP · lwIP
through 2.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112062
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112062
github.com
https://github.com/lwip-tcpip/lwip/blob/STABLE-2_2_1_RELEASE/src/apps/mdns/mdns.c
github.com
https://github.com/lwip-tcpip/lwip/commit/ab2f69c7d8980c01cdd67ed4b23ac61118ed0205
hackmd.io
https://hackmd.io/@haindpwn/lwip-mdns-search-result-domain-oob-write
www.vulncheck.com
https://www.vulncheck.com/advisories/lwip-through-2.2.1-stack-out-of-bounds-write-via-mdns-search-response-handler
hackmd.io
https://hackmd.io/@haindpwn/cve-2026-112062-lwip-mdns-search-result-domain-oob-write
More from lwIP
9.8
CVE-2026-8836
lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow
5.3
CVE-2026-119053
lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()