Advisories › lwIP › ICSA-26-265-02
lwIP (Lightweight IP): 1 CVE, High 8.8
Summary
CISA reports 1 vulnerability in lwIP API. Weakness type: Double Free. Successful exploitation of this vulnerability could result in a system crash, a DoS, or memory corruption, which could lead to code execution on the victim system. Highest CVSS v3 score: 8.8 (High), exploitable from an adjacent network.
What to do: Prioritize: Users of lwIP are encouraged to update their version of lwIP using the repository found at https://cgit.git.savannah.gnu.org/cgit/lwip.git. The commit identifier that contains the fix is f873b6295933e4149a2132adf3e9a2d2a676a5ec.
At a glance
- Vendor
- lwIP
- Products
- API
- CVEs
- CVE-2026-91018
- Highest CVSS v3
- 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Chemical, Communications, Critical Manufacturing, Energy, Financial Services, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems
- Deployed
- Worldwide
- Vendor HQ
- Sweden
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-91018 | Double Free | 8.8 | – | No | The affected product has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system. |
Affected products (1)
- lwIP API: >=2.0.1|<=2.2.1
Vendor fixes and mitigations (from advisory)
- Mitigation: Users of lwIP are encouraged to update their version of lwIP using the repository found at https://cgit.git.savannah.gnu.org/cgit/lwip.git. The commit identifier that contains the fix is f873b6295933e4149a2132adf3e9a2d2a676a5ec. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.