Critical severity · published May 18, 2026
CVE-2026-8836
lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue. Two separate issue reports were submitted to the project. Their processing was merged as a duplicate.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LW
lwIP · Lwip
2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8836
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8836
cgit.git.savannah.gnu.org
https://cgit.git.savannah.gnu.org/cgit/lwip.git/commit/?id=0c957ec03054eb6c8205e9c9d1d05d90ada3898c
github.com
https://github.com/lwip-tcpip/lwip/commit/0c957ec03054eb6c8205e9c9d1d05d90ada3898c
savannah.nongnu.org
https://savannah.nongnu.org/bugs/?68055
savannah.nongnu.org
https://savannah.nongnu.org/bugs/?68194
vuldb.com
https://vuldb.com/cve/CVE-2026-8836
vuldb.com
https://vuldb.com/submit/829798
More from lwIP
5.9
CVE-2026-112062
lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
5.3
CVE-2026-119053
lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()