CVE-2026-112062
What it is
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.
At a glance
- Exploitability
- Can be exploited from the same network segment without logging in. High risk of service disruption.
- Exploit odds
- 0.4% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Details
- Published
- Last modified
- Exploit probability
- 0.4% · EPSS, next 30 days
- Weakness
- CWE-121
- Record status
- Awaiting Analysis
Attack profile CVSS 4.0 · 6.0
- Attack vector
- Adjacent network
- Complexity
- Low
- Attack requirements
- Present
- Privileges needed
- None
- User interaction
- None
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Raw vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix and advisories
References
- https://github.com/lwip-tcpip/lwip/blob/STABLE-2_2_1_RELEASE/src/apps/mdns/mdns.c
- https://github.com/lwip-tcpip/lwip/commit/ab2f69c7d8980c01cdd67ed4b23ac61118ed0205
- https://hackmd.io/@haindpwn/lwip-mdns-search-result-domain-oob-write
- https://www.vulncheck.com/advisories/lwip-through-2.2.1-stack-out-of-bounds-write-via-mdns-search-response-handler
- https://hackmd.io/@haindpwn/cve-2026-112062-lwip-mdns-search-result-domain-oob-write