CVE-2026-112062 in lwIP
Summary
by MITRE • 10/18/2026
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in lwIP versions through 2.2.1 represents a critical security flaw within the Multicast DNS (mDNS) implementation, specifically located in the mdns_handle_response function. This component is responsible for processing incoming mDNS responses from devices on the local network segment. The core technical issue stems from insufficient validation of domain name lengths and resource record data fields during the parsing process. When an attacker sends specially crafted multicast PTR or SRV answers containing invalid domain names, specifically those with oversized RDLENGTH values in PTR records or RDLENGTHs below six bytes in SRV records, the lwIP stack fails to perform adequate bounds checking before writing this data into a fixed-size 256-byte buffer on the call stack. This lack of input validation allows an adjacent attacker to write data beyond the allocated memory boundaries, resulting in a stack-based buffer overflow that corrupts adjacent stack memory and can lead to application crashes or potential remote code execution depending on the specific architecture and compiler protections enabled.
From a technical perspective, this flaw aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-121: Stack-based Buffer Overflow and CWE-20: Improper Input Validation. The vulnerability exploits the trust lwIP places in network packets received from local link devices without rigorous verification of their structural integrity. In mDNS, PTR records map IP addresses to domain names, while SRV records provide information about services available on a host. By manipulating the RDLENGTH field, which indicates the length of the data portion of the resource record, an attacker can force the parser to read or write more bytes than intended. For instance, in SRV responses, if the RDLENGTH is too small, it may cause the parser to misinterpret subsequent stack memory as part of the domain name string, leading to out-of-bounds reads or writes when processing these malformed structures. This behavior demonstrates a failure to enforce strict adherence to protocol specifications regarding field lengths and buffer capacities during packet parsing operations.
The operational impact of this vulnerability is significant for any embedded device or network infrastructure relying on lwIP for its TCP/IP stack functionality, particularly those that actively participate in mDNS service discovery processes such as smart home devices, printers, and IoT sensors. An attacker positioned on the same local area network segment can exploit this flaw by sending malicious multicast responses during a service search operation. The immediate consequence is often a denial of service condition where the affected device crashes or reboots due to stack corruption. However, given that modern processors employ various memory protection mechanisms like stack canaries and non-executable stacks, an attacker with sufficient time and resources might leverage this buffer overflow to overwrite return addresses on the stack. This could potentially allow for arbitrary code execution, granting the attacker control over the compromised device. Such compromise facilitates further lateral movement within the network or enables the device to be used as a pivot point for attacks against other systems.
Mitigation strategies primarily involve upgrading lwIP to version 2.2.2 or later where this issue has been addressed through improved input validation and bounds checking in the mdns_handle_response function. For environments where immediate patching is not feasible, network segmentation can serve as an effective compensating control by isolating vulnerable devices from untrusted local networks. Additionally, deploying intrusion detection systems capable of identifying anomalous mDNS traffic patterns may help detect exploitation attempts before they succeed. Organizations should also review their device configurations to disable unnecessary mDNS functionality if service discovery is not required for the specific use case. Adhering to secure coding practices that emphasize rigorous validation of all external inputs against expected formats and lengths remains essential in preventing similar stack-based vulnerabilities across network protocol implementations. This incident underscores the importance of treating local link protocols with the same level of security scrutiny as internet-facing services, given their frequent exposure to untrusted networks within enterprise and residential environments.