---
id: "CVE-2026-112062"
kind: "vulnerability"
aliases: ["CVE-2026-112062"]
title: "lwIP: mDNS response parsing overflows stack buffer, letting nearby attackers crash devices"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["embedded", "firmware", "iot", "lwip", "mdns", "package"]
not_affected_if: ["mdns-disabled", "no-local-link-exposure"]
published_at: "2026-10-18T13:16:38+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T04:05:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112062", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# lwIP: mDNS response parsing overflows stack buffer, letting nearby attackers crash devices

lwIP, a lightweight TCP/IP stack used in embedded devices, writes past a 256-byte stack buffer in mdns_handle_response when it parses crafted mDNS responses. An attacker on the local link can crash the device, and stack corruption may allow more.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your firmware or project links lwIP and whether mDNS is enabled (`LWIP_MDNS_RESPONDER` or the mDNS client option in your lwipopts.h, if the build uses it)
- Check the lwIP version in your source tree or vendor SDK against `2.2.1`; unknown if the sources give a fixed version

## Fix

- Move to a lwIP release that includes the mdns_handle_response fix (unknown: the sources do not name a fixed version)
- Disable mDNS if the device does not need service discovery (unknown: the sources do not name a setting)

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112062

## From the sources

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_