{"id":"CVE-2026-112062","kind":"vulnerability","aliases":["CVE-2026-112062"],"related":[],"title":"lwIP: mDNS response parsing overflows stack buffer, letting nearby attackers crash devices","description":"lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.","summary":"lwIP, a lightweight TCP/IP stack used in embedded devices, writes past a 256-byte stack buffer in mdns_handle_response when it parses crafted mDNS responses. An attacker on the local link can crash the device, and stack corruption may allow more.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","firmware","iot","lwip","mdns","package"],"not_affected_if":["mdns-disabled","no-local-link-exposure"],"how_to_check":"- Check whether your firmware or project links lwIP and whether mDNS is enabled (`LWIP_MDNS_RESPONDER` or the mDNS client option in your lwipopts.h, if the build uses it)\n- Check the lwIP version in your source tree or vendor SDK against `2.2.1`; unknown if the sources give a fixed version","fix":"- Move to a lwIP release that includes the mdns_handle_response fix (unknown: the sources do not name a fixed version)\n- Disable mDNS if the device does not need service discovery (unknown: the sources do not name a setting)","status":"open","published_at":"2026-10-18T13:16:38+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T04:05:49+00:00","updated_at":"2026-10-25T04:05:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:05:49Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a lwIP release that includes the mdns_handle_response fix (unknown: the sources do not name a fixed version)\n- Disable mDNS if the device does not need service discovery (unknown: the sources do not name a setting)","reach":"network","title":"lwIP: mDNS response parsing overflows stack buffer, letting nearby attackers crash devices","impact":"medium","summary":"lwIP, a lightweight TCP/IP stack used in embedded devices, writes past a 256-byte stack buffer in mdns_handle_response when it parses crafted mDNS responses. An attacker on the local link can crash the device, and stack corruption may allow more.","category":"package","nicknames":[],"who_cares":["lwip","embedded","iot","firmware","mdns"],"confidence":0.6,"needs_auth":"no","worst_case":"Device crashes; stack corruption may allow code execution on the device","analyst_note":"Confirm the fixed lwIP version and whether mDNS responder or client is needed for exposure, using the NVD entry and the lwIP project repository.","how_to_check":"- Check whether your firmware or project links lwIP and whether mDNS is enabled (`LWIP_MDNS_RESPONDER` or the mDNS client option in your lwipopts.h, if the build uses it)\n- Check the lwIP version in your source tree or vendor SDK against `2.2.1`; unknown if the sources give a fixed version","needs_analyst":true,"not_affected_if":["mdns-disabled","no-local-link-exposure"],"who_is_affected":"Devices and firmware that run lwIP 2.2.1 or earlier with mDNS service discovery enabled are exposed, because the flaw is in the mDNS response handler during service search. Attackers must be on the same local link, so systems on isolated networks or without mDNS can skip it. Unknown whether the sources cover other lwIP versions or vendor forks.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":3376,"output_tokens":693,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112062':15A,18A '-2026':14A,17A '2.2.1':68C '256':37B,124C '6':117C 'adjac':84C 'allow':65B,83C 'answer':107C,113C 'attack':10A,52B,85C,98C 'bound':75C 'buffer':7A,40B,127C 'byte':38B,125C 'contain':69C 'corrupt':63B,87C 'craft':48B 'crash':11A,58B,129C 'cve':13A,16A 'devic':12A,33B,60B,131C 'domain':96C 'embed':19B,32B 'firmwar':20B 'handl':43B,80C 'invalid':95C 'iot':21B 'let':8A 'lightweight':27B 'link':56B,102C 'local':55B,101C 'lwip':1A,22B,25B,66C 'may':64B 'mdns':2A,23B,42B,49B,79C,92C 'memori':89C 'multicast':105C 'name':97C 'nearbi':9A 'out-of-bound':72C 'overflow':5A,122C 'overs':109C 'packag':24B 'pars':4A,47B 'past':35B 'ptr':106C 'rdlength':110C,115C 'respons':3A,44B,50B,81C,93C 'search':121C 'send':91C,104C 'servic':120C 'srv':112C 'stack':6A,29B,39B,62B,71C,88C,126C 'tcp/ip':28B 'use':30B 'vulner':77C 'write':34B,76C","nicknames":[],"mitigations":[],"who_affected":"Devices and firmware that run lwIP 2.2.1 or earlier with mDNS service discovery enabled are exposed, because the flaw is in the mDNS response handler during service search. Attackers must be on the same local link, so systems on isolated networks or without mDNS can skip it. Unknown whether the sources cover other lwIP versions or vendor forks.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112062","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112062","severity":null,"published_at":"2026-10-18T13:16:38+00:00","modified_at":"2026-10-19T21:13:39+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}