lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory… (CVE-2026-112062)

The vulnerability in lwIP through version 2.2.1 is a stack out-of-bounds write in the mdns_handle_response function. Local attackers can exploit this by sending multicast mDNS responses with invalid domain names that have either oversized RDLENGTH fields in PTR answers or RDLENGTH fields below 6 in SRV answers. This causes an overflow of a fixed 256-byte stack buffer, leading to memory corruption and device crashes. The CVSS 3.1 score is 5.9 (medium severity), reflecting the attack vector as adjacent network with high attack complexity and no privileges required.

Successful exploitation can cause stack memory corruption and crash the affected device. There is no confidentiality impact, but integrity is low and availability impact is high due to potential device crashes. The vulnerability requires local network access and has high attack complexity, limiting exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local network access to trusted devices and monitor for unusual mDNS traffic patterns. Avoid relying on the vulnerable mdns_handle_response functionality in untrusted environments.