CVE-2026-91018

Double Free in lwIP (lightweight IP)

HIGH

8.8

CVSS Score

Published: September 22, 2026 at 08:25 PM UTC

Updated: September 23, 2026 at 08:00 PM UTC

1 product affected across 1 vendorlwIP

Using lwIP API by lwIP?

Get instant alerts when new vulnerabilities affect lwIP API - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

lwIP · lwip-tcpip

60%

2.0.1 ≤ v ≤ 2.2.12.0.1

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (3)

Source: cverecord

https://cgit.git.savannah.gnu.org/cgit/lwip.git

Source: cverecord

https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-02

Source: cverecord

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-02.json

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHicscert

Attack Vector: ADJACENT_NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusAWAITING ANALYSIS

CWE

CWE-415

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card