Junglewise Threat Intelligence

CVE-2026-8836: lwIP stack overflow in SNMPv3 USM Handler

CVE-2026-8836 · Severity: critical · CVSS 9.8 · Published 2026-05-18

Executive brief

A critical vulnerability exists in lwIP, a widely used lightweight networking stack for embedded systems. The flaw is located in the SNMPv3 component, which handles secure network management communications. An attacker could remotely exploit this issue to crash the device or potentially execute unauthorized code, impacting the reliability and security of industrial or IoT equipment.

Technical details

A stack-based buffer overflow vulnerability exists in the `snmp_parse_inbound_frame` function within `src/apps/snmp/snmp_msg.c` of the lwIP library. The root cause is an improper length check on the `msgAuthenticationParameters` argument during SNMPv3 USM processing. Specifically, the code failed to assert that the incoming TLV value length was within the bounds of `SNMP_V3_MAX_AUTH_PARAM_LENGTH` before decoding. A remote, unauthenticated attacker can trigger this overflow by sending a malicious SNMPv3 packet over the network. This can lead to memory corruption, denial of service, or remote code execution. A patch (commit 0c957ec) has been released to enforce proper bounds checking.

Affected products

  • lwIP Project lwIP up to 2.2.1

Timeline

  • 2026-05-13: patched: Fix committed to lwIP repository
  • 2026-05-18: disclosed: Vulnerability published via VulDB and NVD

References