CVE-2026-112062
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stac
CVSS
5.9
Medium
EPSS
0.2%
p13
KEV
—
Exploit Today
4
0-100
Published: Oct 18, 2026 · Last modified: Oct 19, 2026 · CWE-121
0.2%EPSS · 30 days0.2%
2026-10-192026-10-20
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.
- github.comhttps://github.com/lwip-tcpip/lwip/blob/STABLE-2_2_1_RELEASE/src/apps/mdns/mdns.c
- github.comhttps://github.com/lwip-tcpip/lwip/commit/ab2f69c7d8980c01cdd67ed4b23ac61118ed0205
- hackmd.iohttps://hackmd.io/@haindpwn/lwip-mdns-search-result-domain-oob-write
- www.vulncheck.comhttps://www.vulncheck.com/advisories/lwip-through-2.2.1-stack-out-of-bounds-write-via-mdns-search-response-handler
- hackmd.iohttps://hackmd.io/@haindpwn/cve-2026-112062-lwip-mdns-search-result-domain-oob-write
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-11374410.0 CRI—
——0A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.16hCVE-2026-938887.8 HIG—
——0IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.19hCVE-2026-765878.8 HIG—
——0IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.20hCVE-2026-98699.1 CRI—
——0A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.21hCVE-2026-98179.1 CRI—
——0A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.21hCVE-2026-96609.1 CRI—
——0Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.21h