Executive brief
lwIP (Lightweight IP) is a TCP/IP protocol stack widely used in embedded systems and IoT devices across critical infrastructure sectors including energy, healthcare, and water systems. A double free memory vulnerability in lwIP versions 2.0.1 through 2.2.1 could allow an attacker on the same network to crash affected devices, cause denial of service, corrupt memory, or potentially execute arbitrary code with full system privileges.
Technical details
A double free vulnerability (CWE-415) exists in lwIP API versions 2.0.1 through 2.2.1, where memory is freed twice, potentially leading to memory corruption and code execution. The vulnerability requires adjacent network access (AV:A in CVSS) to trigger and does not require authentication or user interaction, making it reachable from the same network segment. Successful exploitation can result in system crash, denial of service, memory corruption, or arbitrary code execution with the privileges of the affected system. A fix is available in the upstream repository (commit f873b6295933e4149a2132adf3e9a2d2a676a5ec), and users should update to a patched version.
Affected products
- lwIP lwIP (Lightweight IP) >=2.0.1, <=2.2.1
Timeline
- 2026-09-22: disclosed: CISA ICS Advisory ICSA-26-265-02 published
- 2026-09-22: other: Fix available in upstream repository commit f873b6295933e4149a2132adf3e9a2d2a676a5ec