lwIP SMTP client EUVD-2026-95820

Exploitation requires that the target's lwIP build has the optional SMTP client application module (apps/smtp) compiled in and in active use for sending email - this is not part of the core lwIP TCP/IP stack and is off by default in many builds. The overflow is reached through unchecked input sizes handled by the client, meaning an attacker generally needs to control the SMTP server the device talks to (or the server must be compromised/MITM'd) or control the email field data (recipient, subject, body) passed to the client. Limiting factors: the vulnerable code path only exists when the SMTP app is enabled, the device must initiate or perform SMTP transactions, and the specific affected lwIP version is not confirmed in the provided data (CPE version is wildcard).

This is a stack/heap buffer overflow (CWE-120) in the lwIP SMTP client application module, rated 9.3 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N) with high confidentiality, integrity, and availability impact to the vulnerable system - consistent with memory corruption leading to potential remote code execution or crash on resource-constrained embedded/OT devices. The exploitation signals are notably sparse: there is no EPSS score provided, no CISA KEV listing, and no public POC in the supplied data, so this is 'no public exploit identified at time of analysis' rather than active exploitation. The high score is driven by the CVSS vector's assumption of remote, unauthenticated, no-interaction reachability, but the description ('SMTP client does not check the size of inputs') implies the overflow is triggered via data the client processes - typically oversized responses from the SMTP server the device connects to, or oversized caller-supplied email fields - which in practice requires the SMTP client feature to be compiled in and actively sending mail, and often a malicious or compromised mail server in the path. This is a genuine priority for the specific subset of embedded/OT devices that enable lwIP's optional SMTP client, but the AV:N/UI:N rating likely overstates ease of reach for a client-side component; the real-world exposure is narrower than the raw 9.3 suggests. Key missing data: no EPSS, no KEV, no POC, and no confirmed fixed version in the provided references.

An OT/IoT device running lwIP with the optional SMTP client enabled connects to a mail server (or is directed to an attacker-controlled one) to send alert emails. The malicious server returns an oversized response, or an oversized recipient/subject field is passed into the client, overflowing a fixed-size buffer and corrupting memory to crash the device or execute attacker code. No public exploit code is identified at time of analysis.