CVE-2026-8836: Stack-based Buffer Overflow in lwIP
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue.
AI Analysis
Technical Summary
The vulnerability CVE-2026-8836 exists in the lwIP TCP/IP stack up to version 2.2.1, specifically in the snmp_parse_inbound_frame function of the SNMPv3 USM Handler (src/apps/snmp/snmp_msg.c). It is a stack-based buffer overflow triggered by manipulation of the msgAuthenticationParameters argument. This can be exploited remotely without authentication, resulting in high impact on confidentiality, integrity, and availability. A patch identified by commit 0c957ec03054eb6c8205e9c9d1d05d90ada3898c addresses the issue, but no official vendor advisory or remediation level is provided in the available data.
Potential Impact
Successful exploitation of this vulnerability can lead to stack-based buffer overflow, which may allow remote attackers to execute arbitrary code, cause application crashes, or disrupt service availability. The CVSS 4.0 score of 9.3 reflects critical impact on confidentiality, integrity, and availability with no required privileges or user interaction.
Mitigation Recommendations
A patch addressing this vulnerability has been identified (commit 0c957ec03054eb6c8205e9c9d1d05d90ada3898c). It is strongly recommended to apply this patch to affected lwIP versions (2.1.0 through 2.2.1) to remediate the issue. Since no official vendor advisory or remediation level is provided, users should monitor the lwIP project repositories or official channels for confirmation and updated guidance. Patch status is not yet confirmed by a vendor advisory; check the vendor or project repository for the latest remediation information.
CVE-2026-8836: Stack-based Buffer Overflow in lwIP
Description
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue.
CVSS v4.0
Score 9.3critical
Affected software
pkg:github/lwip-tcpip/lwipRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-8836 exists in the lwIP TCP/IP stack up to version 2.2.1, specifically in the snmp_parse_inbound_frame function of the SNMPv3 USM Handler (src/apps/snmp/snmp_msg.c). It is a stack-based buffer overflow triggered by manipulation of the msgAuthenticationParameters argument. This can be exploited remotely without authentication, resulting in high impact on confidentiality, integrity, and availability. A patch identified by commit 0c957ec03054eb6c8205e9c9d1d05d90ada3898c addresses the issue, but no official vendor advisory or remediation level is provided in the available data.
Potential Impact
Successful exploitation of this vulnerability can lead to stack-based buffer overflow, which may allow remote attackers to execute arbitrary code, cause application crashes, or disrupt service availability. The CVSS 4.0 score of 9.3 reflects critical impact on confidentiality, integrity, and availability with no required privileges or user interaction.
Mitigation Recommendations
A patch addressing this vulnerability has been identified (commit 0c957ec03054eb6c8205e9c9d1d05d90ada3898c). It is strongly recommended to apply this patch to affected lwIP versions (2.1.0 through 2.2.1) to remediate the issue. Since no official vendor advisory or remediation level is provided, users should monitor the lwIP project repositories or official channels for confirmation and updated guidance. Patch status is not yet confirmed by a vendor advisory; check the vendor or project repository for the latest remediation information.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-18T14:20:09.110Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0b633fec166c07b0e6173b
Added to database: 05/18/2026, 19:06:39 UTC
Last enriched: 05/26/2026, 08:04:17 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.