CISA Warns of Critical Out-of-Bounds Write in lwIP TCP/IP Stack MQTT Client
A critical out-of-bounds write vulnerability in the lwIP TCP/IP Stack MQTT Client Application could allow attackers to achieve full code execution on affected devices.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory detailing a critical vulnerability, identified as CVE-2026-87121, within the lwIP TCP/IP Stack MQTT Client Application. This flaw, an out-of-bounds write, poses a significant risk to devices utilizing versions 2.0.1 through 2.2.1 of the MQTT client.
Successful exploitation of this vulnerability could enable an unauthenticated attacker to gain complete code execution on the targeted device. The severity of this flaw is underscored by its CVSS v3.1 base score of 9.8, categorizing it as CRITICAL. The vulnerability stems from an out-of-bounds write, a common memory corruption issue that can be leveraged to overwrite adjacent memory regions, potentially leading to arbitrary code execution.
The lwIP TCP/IP Stack is widely deployed across various critical infrastructure sectors, including Chemical, Communications, Critical Manufacturing, Energy, Financial Services, Healthcare and Public Health, Transportation Systems, and Water and Wastewater Systems. Its global reach means that a wide array of industrial control systems (ICS) and operational technology (OT) environments could be affected, making this a matter of significant concern for national security.
CISA is urging users of the affected lwIP versions to update to a patched version. The specific fix is available via commit identifier f89407ea711879c04d91c92b35d67be78bbaf0f1 in the lwIP repository, which can be found at https://savannah.nongnu.org/projects/lwip.
In addition to applying the patch, CISA recommends several defensive measures to mitigate the risk of exploitation. These include minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, and locating control system networks behind firewalls and isolating them from business networks. When remote access is necessary, organizations should utilize secure methods like Virtual Private Networks (VPNs), ensuring these are also kept up-to-date.
While no known public exploitation of this specific vulnerability has been reported to CISA at this time, the critical nature of the flaw and its widespread deployment warrant immediate attention. The vulnerability was reported to CISA by Shahriyar Jalayeri of ByteRay Ltd.
This advisory serves as a crucial reminder of the ongoing security challenges within the operational technology landscape. As critical infrastructure becomes increasingly interconnected, vulnerabilities in foundational components like TCP/IP stacks can have far-reaching consequences. Proactive patching and robust network segmentation remain paramount in defending these vital systems against potential cyber threats.
This CISA advisory details a critical double free vulnerability, CVE-2026-91018, affecting lwIP versions API >=2.0.1|<=2.2.1. While the previous advisory focused on an out-of-bounds write in the MQTT client, this new report highlights a different vulnerability within the core lwIP stack that can lead to system crashes, denial of service, memory corruption, and potentially code execution. The advisory also provides a specific commit identifier, f873b6295933e4149a2132adf3e9a2d2a676a5ec, that contains the fix.