LiveActive security incident?Get immediate response
CVE Record

CVE-2026-8836: lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow

A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue. Two separate issue reports were submitted to the project. Their processing was merged as a duplicate.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A remotely reachable flaw in lwIP’s SNMPv3 authentication handling can overwrite stack memory when processing a crafted authentication parameter. This could disrupt affected networked products and may compromise confidentiality, integrity, or availability. Actual exposure depends on whether a product uses an affected lwIP version and enables the vulnerable SNMPv3 USM code.

Executive priority

Treat internet-facing or broadly reachable SNMPv3 implementations as an urgent patching priority. Prioritize asset discovery because lwIP is commonly embedded and its version may be hidden by device firmware. Critical severity warrants rapid action, although active exploitation is not established by the supplied evidence.

Technical view

CVE-2026-8836 is a stack-based buffer overflow in snmp_parse_inbound_frame within src/apps/snmp/snmp_msg.c. Manipulating msgAuthenticationParameters can trigger memory corruption remotely. The supplied record identifies lwIP 2.1.0 through 2.2.1 as affected and names commit 0c957ec03054eb6c8205e9c9d1d05d90ada3898c as the patch.

Likely exposure

Potentially exposed systems include products containing lwIP 2.1.0–2.2.1 where the affected SNMPv3 USM handler is enabled and reachable. The bundle does not identify specific downstream devices, firmware, default configurations, or network ports. Asset and vendor verification is therefore necessary.

Exploitation context

The supplied CVSS v2 score is 10.0 and indicates network reachability, low complexity, and no authentication. Its temporal vector reports proof-of-concept availability, but the bundle provides no exploit details. The CVE is not listed as KEV, and the supplied sources do not establish active exploitation.

Researcher notes

The record maps the issue to CWE-119 and CWE-121. Two project reports were reportedly merged as duplicates. Several Savannah links are marked broken in the bundle, limiting independent review of the original reports. The patch commit is the clearest remediation reference; downstream product impact remains unspecified.

Mitigation direction

  • Apply vendor firmware or an lwIP build containing patch commit 0c957ec03054eb6c8205e9c9d1d05d90ada3898c.
  • Request confirmation from product vendors when bundled lwIP versions are not externally visible.
  • Restrict SNMP access to authorized management systems until remediation is complete.
  • Disable the affected SNMPv3 USM functionality where operationally safe and vendor-supported.

Validation and detection

  • Inventory products and firmware that embed lwIP and provide SNMPv3 functionality.
  • Confirm whether deployed source or firmware contains lwIP versions 2.1.0 through 2.2.1.
  • Verify the vulnerable SNMPv3 service is enabled and reachable from untrusted networks.
  • Confirm patched builds include commit 0c957ec03054eb6c8205e9c9d1d05d90ada3898c or a vendor-designated equivalent.
  • Regression-test SNMPv3 authentication using safe, vendor-approved validation procedures.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-119: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · low confidence lookup

CWE-121: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-8836 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (2.0)
Known Exploited
No
Published

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

4CVSS vectors
6Timeline events
1ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

4 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 2.0CriticalAV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C1010VulDB
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C3.95.9VulDB
9.8CVSS 3.0CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C3.95.9VulDB
9.3CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P——VulDB

Vulnerability scoring details

Base CVSS 4.0 score

9.3Critical
CVSS 4.0 vector shape for CVE-2026-8836Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineVulDB

    Advisory disclosed

  2. Source timelineVulDB

    VulDB entry created

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

  6. Source timelineVulDB

    VulDB entry last update

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/alwIP2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.2.0, 2.2.1Listed
Weakness

CWE details

CWE-119CWE-121

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.