A vulnerability was found in lwIP up to 2.2.1. (CVE-2026-8836)
Description
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue.
CVSS v3.1
Score 9.8critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-8836 is a critical vulnerability in lwIP (up to version 2.2.1) affecting the snmp_parse_inbound_frame function within src/apps/snmp/snmp_msg.c, specifically in the SNMPv3 USM Handler component. The vulnerability arises from improper handling of the msgAuthenticationParameters argument, resulting in a stack-based buffer overflow. This flaw allows remote attackers to execute arbitrary code or cause denial of service. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high exploitability and impact. A patch identified by commit 0c957ec03054eb6c8205e9c9d1d05d90ada3898c is suggested to address the issue, though no direct vendor advisory or patch link is provided.
Potential Impact
Successful exploitation of this vulnerability can lead to remote code execution, complete compromise of the affected system's confidentiality, integrity, and availability due to a stack-based buffer overflow. The vulnerability requires no privileges or user interaction and can be triggered remotely, making it highly severe.
Mitigation Recommendations
A patch identified by commit 0c957ec03054eb6c8205e9c9d1d05d90ada3898c is suggested to remediate this vulnerability. Since no official vendor advisory or patch link is provided, users should verify and apply the patch from the official lwIP source repository or vendor channels. Patch status is not yet confirmed in official advisories—check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3w8m-3w76-f6mh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-8836"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a89a6c8acd9273b49150b0e
Added to database: 08/22/2026, 13:40:24 UTC
Last enriched: 08/22/2026, 13:41:53 UTC
Last updated: 10/06/2026, 06:48:21 UTC
Views: 91
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.