CVE-2026-15340

Summary

The lwIP SMTP client has a buffer overflow vulnerability due to unchecked input sizes, which can lead to arbitrary code execution when processing email messages. This critical flaw allows attackers to overwrite memory and potentially take control of the affected system.

Exploitability

Exploitation is relatively straightforward with remote code execution potential, requiring only a crafted SMTP message to trigger the buffer overflow in the lwIP library.

Blast radius

The vulnerability affects embedded systems using lwIP's SMTP client, potentially impacting thousands of devices including routers, IoT appliances, and networked embedded platforms that process email communications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to lwIP version 2.590 or later to address this buffer overflow vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.