CVE-2026-119053
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in…
- Risk score
- 40/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or p…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.3 medium
References
- https://github.com/lwip-tcpip/lwip
- https://github.com/lwip-tcpip/lwip/blob/77dcd25a72509eb83f72b033d219b1d40cd8eb95/src/apps/snmp/snmp_pbuf_stream.c#L111-L122
- https://github.com/lwip-tcpip/lwip/commit/e98415014aca66ef0daefded8020763b9279a3b2
- https://www.vulncheck.com/advisories/lwip-2.0.0-through-2.2.1-snmp-agent-out-of-bounds-read-via-snmp-pbuf-stream-writeto
Original description
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
Last activity 29 Oct 2026. Patch Forecast updates every hour.