Savannah lwIP SMTP client: Buffer overflow due to missing input size check
Summary
The SMTP client of the lightweight TCP/IP stack lwIP does not check the size of inputs, which can lead to a buffer overflow. CISA reports that successful exploitation could crash the affected device, and a buffer overflow may allow remote code execution. CISA rates the issue as critical (CVSS v4.0 9.3, CVSS v3.1 9.8), but no exploitation has been reported.
Affected
- Savannah lwIP SMTP client 2.2.1
- Other versions: Unknown.
Fixed in
- Patch patch_125_smtp_txbuf.diff (git commit 614420f82c8729d070e01464c0dddb3c9525c772), according to CISA and CVE record.
- Fixed version number: Unknown.
Workaround
- No vendor-specific workaround known.
- Keep affected devices off the internet and separate them from business networks with firewalls.
Exploitation
- Known exploitation in the wild: No, according to CISA SSVC (Exploitation: none) and secondary sources.
- CISA KEV listing: No.
- Public proof of concept: None found in the reviewed sources.
- Automatable: Yes, according to CISA SSVC.
Our recommendation
- Inventory devices that send email alerts and check whether they embed lwIP SMTP client 2.2.1.
- Keep such devices off the internet and restrict their outbound traffic.
- Ask device suppliers for a patch statement referencing CVE-2026-15340 and validate any fix before deploying it.
- Monitor NVD and CISA for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICSA-26-279-02 www.cisa.gov
- CISA CSAF file ICSA-26-279-02 github.com
- HOL CVE record CVE-2026-15340 hol.org
- Strix CVE record CVE-2026-15340 www.strix.ai
- Red Piranha threat intelligence report, 6-12 Oct 2026 redpiranha.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:41.
Original description (NVD)
lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.