lwIP CVE-2026-112062

Exploitation requires (1) the lwIP MDNS application to be compiled in and enabled, and (2) the target device to be actively performing an mDNS service search when the attacker's response arrives - this service-search state is the specific trigger (reflected as AT:P) and is the primary limiting factor, not a mere timing nicety. The attacker must be on the same local link (AV:A) to send the multicast mDNS answer, but needs no authentication (PR:N) and no user interaction (UI:N). The concrete malicious inputs are a multicast PTR answer with oversized RDLENGTH, or an SRV answer with RDLENGTH below 6 (less than the fixed SRV header size), which drive an out-of-bounds write against the 256-byte stack domain buffer. Limiting factors: local-link adjacency requirement, dependence on the optional mDNS feature being active and in a search state, and affected versions being lwIP through 2.2.1.

This is a genuine but moderate-priority issue, not a top-tier emergency. The vendor-assigned CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H) scores 6.0 and the signals are internally consistent: exploitation is limited to the local link (AV:A) and requires a present attack condition (AT:P) - the target device must be actively performing an mDNS service search when the malicious response arrives. Impact is dominated by availability (VA:H - device crash) with only low integrity impact (VI:L, the bounded stack corruption) and no confidentiality impact (VC:N). Although CWE-121 (stack-based overflow) can in principle enable code execution, both the description ('crashing the device') and the VI:L/VC:N rating indicate the realistic, demonstrated outcome is a denial of service rather than reliable RCE; any RCE claim would be speculation beyond the provided data. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation; VulnCheck reporting plus a public technical writeup raise the likelihood of a working exploit emerging, but POC/exploit-code availability is not confirmed in the input. Net: prioritize patching on embedded/IoT fleets reachable from untrusted local networks (guest Wi-Fi, shared LANs) that use lwIP's mDNS service discovery, but this is not a drop-everything remote-unauthenticated-internet-facing RCE.

An attacker on the same local link (e.g., shared office/guest Wi-Fi or LAN segment) waits for or induces an lwIP-based embedded device to perform an mDNS service search, then sends a crafted multicast PTR answer with an oversized RDLENGTH (or an SRV answer with RDLENGTH below 6). The malformed domain data overflows the 256-byte stack buffer in mdns_handle_response, corrupting the stack and crashing the device. A detailed public technical writeup exists, but no confirmed exploit code is identified in the provided data.