Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-8836

A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:09481bd85b7d4e9197ac760decee79a4d36b8a39c43c70669998641cd3ac6f43
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
2

Preserved source conflicts

No provider value was silently selected as the winner.

cvss · 4 assertions

{"metric":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C","version":"3.0"},"metric_type":"cvssV3_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/metrics/2/cvssV3_0

{"metric":{"baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X","version":"4.0"},"metric_type":"cvssV4_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/metrics/0/cvssV4_0

{"metric":{"baseScore":10,"vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C/E:ND/RL:OF/RC:C","version":"2.0"},"metric_type":"cvssV2_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/metrics/3/cvssV2_0

{"metric":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/metrics/1/cvssV3_1
cwe · 2 assertions

{"cweId":"CWE-119","description":"Memory Corruption","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-121","description":"Stack-based Buffer Overflow","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"cpes":["cpe:2.3:a:lwip:lwip:*:*:*:*:*:*:*:*"],"modules":["snmpv3 USM Handler"],"product":"lwIP","vendor":"n/a","versions":[{"status":"affected","version":"2.1.0"},{"status":"affected","version":"2.1.1"},{"status":"affected","version":"2.1.2"},{"status":"affected","version":"2.1.3"},{"status":"affected","version":"2.2.0"},{"status":"affected","version":"2.2.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/affected/0

Provider-owned CVSS observations

4 source assertions
{"metric":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C","version":"3.0"},"metric_type":"cvssV3_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/metrics/2/cvssV3_0
{"metric":{"baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X","version":"4.0"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/metrics/0/cvssV4_0
{"metric":{"baseScore":10,"vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C/E:ND/RL:OF/RC:C","version":"2.0"},"metric_type":"cvssV2_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/metrics/3/cvssV2_0
{"metric":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/metrics/1/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-119","description":"Memory Corruption","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-121","description":"Stack-based Buffer Overflow","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/problemTypes/0/descriptions/0

Source references

6 source assertions
{"tags":["broken-link","patch"],"url":"https://cgit.git.savannah.gnu.org/cgit/lwip.git/commit/?id=0c957ec03054eb6c8205e9c9d1d05d90ada3898c"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/references/4
{"tags":["patch"],"url":"https://github.com/lwip-tcpip/lwip/commit/0c957ec03054eb6c8205e9c9d1d05d90ada3898c"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/references/5
{"tags":["broken-link"],"url":"https://savannah.nongnu.org/bugs/?68194"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/references/3
{"name":"Submit #829798 | lwIP 2.1.0 Stack-based Buffer Overflow","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/829798"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/references/2
{"name":"VDB-364474 | lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/vuln/364474"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/references/0
{"name":"VDB-364474 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/364474/cti"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:374f219b7d3bc6b3853278855ac7b2682c95ea12e8affae63f48148a65aba740 · sha256:658333b1d523517a… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer