lwIP Fixes MQTT and API Memory-Corruption Vulnerabilities

Quick Answer

Two CISA advisories cover lwIP 2.0.1-2.2.1: an MQTT out-of-bounds write with possible code execution, and an API double-free that may crash or corrupt the system. They have different network scopes and separate fixes. Embedded-device operators need firmware containing the relevant commits, not merely an updated source checkout.

Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	lwIP TCP/IP stack MQTT and API components
Advisory	ICSA-26-265-01 / ICSA-26-265-02
CVEs	CVE-2026-87121, CVE-2026-91018
Earliest listed CVE record publication	2026-09-22 19:48:25.046 UTC
Latest listed CVE record publication	2026-09-22 20:25:33.530 UTC
Affected versions	lwIP 2.0.1 through 2.2.1 in the MQTT and affected API paths described by ICS-CERT
Fixed version	Apply upstream commits f89407ea711879c04d91c92b35d67be78bbaf0f1 and f873b6295933e4149a2132adf3e9a2d2a676a5ec or a vendor release containing them
CVSS base score	8.8 / 9.8 (CVSS v3.1); 8.7 / 9.3 (CVSS v4.0)
CVSS severity	High to Critical
Exploitation status	CISA says no known public exploitation specifically targeting either vulnerability had been reported at the time of its advisories. This is a bounded authority statement, not proof that each device is uncompromised.

What Changed

CVE-2026-87121 affects the MQTT client component and has a network attack vector. CVE-2026-91018 concerns an API double-free; CISA gives it an adjacent-network vector and says it is not remotely exploitable in its advisory wording. Do not generalize the MQTT network scope to every lwIP API path or device.

What To Validate Now

1. Inventory. Locate lwIP TCP/IP stack MQTT and API components deployments, versions, enabled features, exposure paths, owners, and dependent services.
2. Establish applicability. Compare each deployment with the authority's affected-version statement: lwIP 2.0.1 through 2.2.1 in the MQTT and affected API paths described by ICS-CERT Do not infer applicability from product family or severity alone.
3. Remediate. Include commit f89407ea711879c04d91c92b35d67be78bbaf0f1 for CVE-2026-87121 and f873b6295933e4149a2132adf3e9a2d2a676a5ec for CVE-2026-91018, or use a device-vendor release containing them. Confirm applicability and backport dependencies with the firmware maintainer.
4. Validate. Record firmware build/hash and evidence that the relevant fix is included. In an approved test system, verify MQTT sessions, API-dependent networking and recovery before production deployment; no hardware or industrial process test was performed here.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

CISA recommends limiting control-system exposure, segmenting networks and assessing operational impact before applying defensive measures. Coordinate isolation, firmware rollout and recovery with the device vendor; do not probe live control systems with malformed traffic.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• ICSA-26-265-01
• ICSA-26-265-02

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.