← Back to Feed

lwIP (Lightweight IP)

CVE-2026-91018

September 22, 2026 · CISA (US-CERT) · Severity: CRITICAL

This advisory from CISA describes a critical double free vulnerability (CVE-2026-91018) in the lwIP lightweight TCP/IP stack, affecting versions 2.0.1 through 2.2.1. Successful exploitation could result in system crashes, denial of service, memory corruption, or code execution, posing significant risks to critical infrastructure sectors globally. 📌 **Analyst Note:** Given lwIP's widespread use in embedded and IoT devices across critical infrastructure, this vulnerability demands immediate patching. Organizations should prioritize updating affected systems and review network segmentation to limit exposure, as the high CVSS score indicates ease of exploitation an

Key Takeaways

  • A double free vulnerability in lwIP versions 2.0.1 through 2.2.1 could allow an attacker to crash the system, cause a denial of service, or corrupt memory, potentially leading to remote code execution on the victim system.
  • The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and affects critical infrastructure sectors worldwide, including chemical, energy, healthcare, and transportation systems, with the vendor based in Sweden.
  • Users are strongly advised to update lwIP using the official repository to commit f873b6295933e4149a2132adf3e9a2d2a676a5ec, which contains the fix, and to minimize network exposure for control system devices as a recommended practice.
☕ Buy a Coffee