lwIP's Fixes for Two Critical Bugs Predate CISA's Advisory

CISA disclosed two critical vulnerabilities Sept. 22 in lwIP, an open-source TCP/IP stack embedded in routers, medical devices, building controls and industrial equipment worldwide: an out-of-bounds write in its MQTT client rated 9.8 out of 10 on the CVSS v3.1 scale, and a double-free bug in the core stack rated 8.8.

CVE	Component	Weakness	CVSS v3.1
CVE-2026-87121	MQTT client, versions 2.0.1-2.2.1	Out-of-bounds write (CWE-787)	9.8
CVE-2026-91018	Core stack, API versions 2.0.1-2.2.1	Double free (CWE-415)	8.8

CVE-2026-87121 is reachable over the network with no credentials and no user interaction, and CISA's advisory says successful exploitation "could allow an attacker to gain full code execution on the device." CVE-2026-91018 needs an attacker already on the same local network segment, a precondition built into its CVSS vector that keeps it from being exploitable directly from the open internet.

The fixes were public three weeks before the advisory

lwIP's own git repository shows both bugs were already fixed before CISA published either advisory. Maintainer Simon Goldschmidt committed "mqtt: fix rx_buffer overrun" on Aug. 31, adding a bounds check before the client writes into its receive buffer and noting the bug "has been reported multiple times." The same day, he committed a separate fix to the 6LoWPAN decompression path that replaced a goto-based error branch with a direct return, the change CISA's advisory cites as the fix for the double-free bug.

That means an operator who tracked lwIP's commit log rather than waiting for a CVE would have had both fixes available three weeks before Sept. 22, the day CISA formally named CVE-2026-87121 and CVE-2026-91018 and assigned them scores. Neither CISA advisory mentions the Aug. 31 commit date; both simply point to the fixed commit hash as the remediation.

lwIP has no dedicated security advisory page and no version-tracking dashboard of its own, unlike vendors that ship a single commercial product. Anyone running it has to pull the fix from the same public git tree everyone else reads, which is also why the gap between a patch landing and a CVE existing for it is so easy to miss.

Who found them, and what CISA still doesn't say

Shahriyar Jalayeri of ByteRay Ltd. is credited with reporting the MQTT client flaw, and Eric Evenchick of Tetrel Security is credited with the core double-free. CISA's advisory for the MQTT bug says no known public exploitation has been reported to the agency at this time, and neither advisory says whether either researcher was paid a bounty or when they first reported their finding to the lwIP project.

Both advisories list the same affected sectors: chemical, communications, critical manufacturing, energy, financial services, healthcare, transportation and water and wastewater systems, with deployment described as worldwide. lwIP does not publish a customer list, the way Zyxel's switch advisory at least named a specific product line; anyone running an embedded device built in the last decade has to check its lwIP version to know if either bug applies to them, the same self-service burden GitHub-hosted infostealer campaigns put on developers who cloned the wrong repository without checking who published it.