Live › vulnerability › CVE-2026-112062
Go to dashboardlwIP, a lightweight TCP/IP stack used in embedded devices, writes past a 256-byte stack buffer in mdns_handle_response when it parses crafted mDNS responses. An attacker on the local link can crash the device, and stack corruption may allow more.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Devices and firmware that run lwIP 2.2.1 or earlier with mDNS service discovery enabled are exposed, because the flaw is in the mDNS response handler during service search. Attackers must be on the same local link, so systems on isolated networks or without mDNS can skip it. Unknown whether the sources cover other lwIP versions or vendor forks.
No product ranges from the sources yet.
LWIP_MDNS_RESPONDER or the mDNS client option in your lwipopts.h, if the build uses it)2.2.1; unknown if the sources give a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.
This page as .md · .json · in your agent: get_signal("CVE-2026-112062")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.