Savannah lwIP SMTP client

View CSAF Summary Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. The following versions of Savannah lwIP SMTP client are affected: lwIP SMTP client 2.2.1 (CVE-2026-15340) CVSS Vendor Equipment v3 9.8 Savannah lwIP SMTP client 1 Vulnerability Buffer Copy without Checking Size of Input ('Classic Buffer

Back to dashboard

Threat CriticalSingle SourceAgencyConf ConfirmedUnited States · North AmericaPublishedStatus: PublishedCERTOpen original source

Original publisher

CERT

Original source URL

https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-02

Source country

United States

Reporting region

North America

Language

Institution

CISA US-CERT

Published (UTC)

Oct 6, 2026, 12:00 PM

Ingested (UTC)

Oct 16, 2026, 3:02 PM

Verification

Single Source

BASE INTEL aggregates public reporting. This item is not authored by BASE INTEL. Always review the original publisher before relying on the content.

Savannah lwIP SMTP client
Advisory ID: icsa-26-279-02
View CSAF Summary Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. The following versions of Savannah lwIP SMTP client are affected: lwIP SMTP client 2.2.1 (CVE-2026-15340) CVSS Vendor Equipment v3 9.8 Savannah lwIP SMTP client 1 Vulnerability Buffer Copy without Checking Size of Input ('Classic Buffer
Severity: critical
Published (UTC): 2026-10-06T12:00:00.000Z
Source: CERT
Original source: https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-02

View original source