CVE-2026-112062
Received Received - Intake

Stack Out-of-Bounds Write in lwIP MDNS Parser

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulnCheck

Description
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-112062
EUVD
EUVD-2026-103504

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lwIP lwIP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack out-of-bounds write flaw in the lwIP TCP/IP stack's MDNS (Multicast DNS) responder implementation. It occurs in the mdns_handle_response function when processing mDNS responses with invalid domain names. Attackers on the local network can send crafted multicast PTR or SRV answers with oversized RDLENGTH or insufficient data, causing a 256-byte stack buffer overflow. This may crash the device or lead to denial-of-service conditions.

Detection Guidance

Monitor network traffic on port 5353 for malformed mDNS responses. Use tools like tcpdump to capture packets: tcpdump -i any -n port 5353 -w mdns_traffic.pcap. Inspect captured packets for PTR or SRV answers with RDLENGTH values exceeding 256 bytes or below 6. Check for crashes in lwIP-based devices after receiving mDNS responses.

Impact Analysis

This vulnerability can disrupt network services relying on MDNS for service discovery, causing crashes or instability in affected devices. Since it allows stack memory corruption, it may also lead to denial-of-service conditions or potential information disclosure if exploited.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions or crashes in devices using lwIP's MDNS responder, which could disrupt network services. While it does not directly expose personal data, prolonged disruption may impact systems handling sensitive information, potentially violating availability requirements in GDPR or HIPAA. However, no evidence suggests direct data breaches or non-compliance from this specific flaw alone.

Mitigation Strategies

Upgrade lwIP to a version containing the fix in commit ab2f69c7d8980c01cdd67ed4b23ac61118ed0205. If upgrading is not possible, disable mDNS functionality on affected devices or restrict local network access to prevent malicious mDNS responses from reaching vulnerable systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112062. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart