CVE-2026-119053: lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()
lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmppbufstreamwriteto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using lwIP versions 2.0.0 through 2.2.1 are exposed when built with the SNMP agent. The issue is reachable remotely through fragmented SNMP requests.
What does an attacker need to exploit this?
An attacker does not need authentication, but must know the SNMP read community. They can then send fragmented SNMP requests crafted to trigger the out-of-bounds read.
What information could be disclosed?
Affected responses can echo adjacent receive-buffer or pool memory. The stated impact is confidentiality loss; no integrity or availability impact is described.