---
id: CVE-2026-112062
title: lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
summary: >-
  lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in
  mdns_handle_response that allows adjacent attackers to corrupt stack memory by
  sending mDNS responses with invalid domain names. Attackers on the local link
  can sen…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-121
vendor: lwIP
product: lwIP
affected:
  - lwIP <= 2.2.1
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T12:19:52.023Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112062'
references:
  - url: 'https://hackmd.io/@haindpwn/lwip-mdns-search-result-domain-oob-write'
  - url: >-
      https://github.com/lwip-tcpip/lwip/commit/ab2f69c7d8980c01cdd67ed4b23ac61118ed0205
  - url: >-
      https://github.com/lwip-tcpip/lwip/blob/STABLE-2_2_1_RELEASE/src/apps/mdns/mdns.c
  - url: >-
      https://www.vulncheck.com/advisories/lwip-through-2.2.1-stack-out-of-bounds-write-via-mdns-search-response-handler
    label: >-
      VulnCheck Advisory: lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS
      Search Response Handler
tags:
  - cve.org
ingestedAt: '2026-10-18T12:41:54.059Z'
---

## Overview

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6 during a service search, overflowing a 256-byte stack buffer and crashing the device.

## Affected

- `lwIP <= 2.2.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.