CISA flags lwIP double-free vulnerability hitting critical infrastructure
The advisory arrives a day after CISA's prior lwIP notice, this one CVSS 8.8, adjacent-network exploitable, no public exploit confirmed yet.
TL;DR
CISA disclosed CVE-2026-91018, a double-free vulnerability in lwIP versions 2.0.1 through 2.2.1, with a CVSS 3.1 score of 8.8. The advisory lists affected critical infrastructure sectors: chemical, communications, critical manufacturing, energy, financial services, healthcare and public health, transportation systems, and water and wastewater systems. A patch is available via commit f873b6295933e4149a2132adf3e9a2d2a676a5ec. Eric Evenchick of Tetrel Security reported the vulnerability. CISA states no known public exploitation targeting this vulnerability has been reported at this time.
CISA published an ICS advisory Tuesday for CVE-2026-91018, a double-free vulnerability in the lwIP open-source TCP/IP stack. The affected API versions span 2.0.1 through 2.2.1. Successful exploitation could crash the system, cause denial of service, corrupt memory, or enable code execution on the victim system.
The vulnerability carries a CVSS 3.1 base score of 8.8 and a CVSS 4.0 score of 8.7, both HIGH. The attack vector is adjacent network, not remote: an attacker needs to be on the same network segment as the target. CISA's advisory lists eight critical infrastructure sectors as affected and notes worldwide deployment.
This is the second lwIP advisory from CISA in as many days. On Monday, CISA published an advisory for CVE-2026-8836, a stack-based buffer overflow in the SNMPv3 USM handler affecting lwIP through version 2.2.1. That vulnerability carried a CVSS 3.1 score of 9.8 and was also reported by Eric Evenchick of Tetrel Security. Two advisories in two days, same reporter, same library, the pattern suggests researchers are systematically mining lwIP's codebase. lwIP is widely embedded in industrial controllers, IoT devices, and medical equipment, often without the asset owner knowing it's there.
Mitigation for CVE-2026-91018 is straightforward: apply the patch from commit f873b6295933e4149a2132adf3e9a2d2a676a5ec in the lwIP git repository. The harder problem is finding every device that links against the affected versions. CISA's advisory doesn't list specific device models, it names the library itself as the affected product. For ICS asset owners, that means inventorying embedded devices and checking firmware bills of materials, if they exist.
The advisory notes this vulnerability is not exploitable remotely, and CISA has received no reports of public exploitation. The adjacent-network constraint limits the immediate risk for devices behind proper segmentation, but it doesn't eliminate it, a compromised engineering workstation or contractor laptop on the same VLAN could serve as the launch point.
Published ·Deep Fathom