CVE-2026-8836 - Stack Overflow in lwIP SNMPv3

CVE-2026-8836 is a stack-based buffer overflow vulnerability in lwIP, a critical component for embedded and IoT systems. The flaw resides in the snmp_parse_inbound_frame function of the SNMPv3 USM handler and is triggered by manipulation of message authentication parameters (msgAuthenticationParameters). This vulnerability primarily affects IoT routers, embedded network devices, and any systems implementing SNMPv3 on lwIP up to version 2.2.1.

With a CVSS score of 9.8, this is a critical vulnerability. Remote attackers can exploit it to gain complete control of vulnerable systems. A patch has been made available by the lwIP project (commit 0c957ec03054eb6c8205e9c9d1d05d90ada3898c) and the CVE was published on May 18, 2026. Community attention signals have continued into recent days (November 2026), with reports of use in test environments to demonstrate the impact of the flaw.

For defenders: immediately inventory systems using lwIP, particularly routers and IoT devices managing SNMPv3. If the patch is applicable, install it without delay. If updating is not immediately possible, disable SNMPv3 service until patching is complete, or isolate devices from the network until remediation. Also verify configuration backups: compromise of these systems would have significant consequences for infrastructure resilience.