CVE-2026-8836
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A vulnerability was found in lwIP up to 2.2.1 in the snmp_parse_inbound_frame function of src/apps/snmp/snmp_msg.c in the SNMPv3 USM handler. Manipulating the msgAuthenticationParameters argument results in a stack-based buffer overflow. The attack can be initiated remotely. A patch named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c is available.
Risk Assessment
The vulnerability may allow a remote attacker to execute code or cause a denial of service, potentially compromising system integrity and availability.
Recommendation
It is recommended to immediately apply the available patch (0c957ec03054eb6c8205e9c9d1d05d90ada3898c) to remediate the vulnerability.
Other vulnerabilities in lwIP
See all- CVE-2026-87121Critical
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.
- CVE-2026-91018High
lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.
Original NVD description (English source)
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue. Two separate issue reports were submitted to the project. Their processing was merged as a duplicate.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS