Savannah lwIP SMTP client

CRITICAL

CVSS 9.8

Date 2026-10-06T06:00:00+00:00

Source cisa-csaf

Published by CISA

// Description

Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution.

// Vulnerabilities (1)

CVE ID	CVSS Score	Severity	Description
CVE-2026-15340	9.8	critical	lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

// Remediations (1)

Mitigation: xchglabs reports that the vulnerability was fixed and released in the following patch: patch_125_smt

xchglabs reports that the vulnerability was fixed and released in the following patch: patch_125_smtp_txbuf.diff . This is available as available as git commit (614420f82c8729d070e01464c0dddb3c9525c772)

// References

CISA ICSA-26-279-02
CISA https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-279-02.json
CISA https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-02
CISA https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
CISA https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
CISA https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
CISA https://www.cisa.gov/topics/industrial-control-systems
CISA https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
CISA https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
CISA https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
CISA https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
CISA https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks