CVE-2026-8836
Critical
Description
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue. Two separate issue reports were submitted to the project. Their processing was merged as a duplicate.
SeverityCritical
CVSS9.8
Exploit probability—
ProductLwip
PublishedMay 18, 2026
First seenMay 18, 2026
Weakness typeCWE-121CWE-121CWE-119Memory buffer bounds error
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lwip lwip | 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.2.0, 2.2.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.