CVE-2026-119053 Details
Description
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
A vulnerability allowing out-of-bounds read has been identified in lwIP versions 2.0.0 through 2.2.1, when built with the SNMP agent. The issue arises in the function snmp_pbuf_stream_writeto(), which incorrectly bounds memory copies by the pbuf length instead of the remaining bytes. This flaw enables remote, unauthenticated attackers who are aware of the read community to send fragmented SNMP requests that trigger the leakage of adjacent memory from the receive buffer or memory pool into the SNMP responses.
Users can upgrade to lwIP version 2.2.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lwIP | >= 2.0.0, <= 2.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | New CVE Received | [email protected] |
| Oct 29, 2026 | CVE Modified | CISA-ADP |