CVE-2026-87121 Overview
CVE-2026-87121 is an out-of-bounds write vulnerability in the Message Queuing Telemetry Transport (MQTT) implementation of the lwIP TCP/IP stack. The lwIP stack is a widely deployed lightweight networking library used across embedded systems, industrial control devices, and Internet of Things (IoT) products. Attackers can exploit this flaw over the network without authentication or user interaction to achieve full code execution on affected devices. The vulnerability is tracked under CWE-787: Out-of-bounds Write and was published to the National Vulnerability Database on September 22, 2026.
Critical Impact
Unauthenticated remote attackers can trigger memory corruption in the lwIP MQTT client to gain arbitrary code execution on embedded and industrial control system devices.
Affected Products
- lwIP TCP/IP Stack MQTT client component
- Embedded and Internet of Things (IoT) devices integrating the lwIP MQTT client
- Industrial control systems referenced in CISA ICS Advisory ICSA-26-265-01
Discovery Timeline
- 2026-09-22 - CVE-2026-87121 published to the National Vulnerability Database
- 2026-09-23 - Record last modified in the NVD database
Technical Details for CVE-2026-87121
Vulnerability Analysis
The vulnerability resides in the MQTT client implementation shipped with the lwIP TCP/IP stack. MQTT is a publish-subscribe messaging protocol used extensively for constrained devices and machine-to-machine communication in industrial networks. The lwIP MQTT client parses server-supplied protocol messages and writes portions of the payload into fixed-size internal buffers. When the client processes malformed or oversized fields, it writes beyond the allocated buffer boundary, corrupting adjacent memory.
Because lwIP is deployed on constrained targets that typically lack modern exploit mitigations such as Address Space Layout Randomization (ASLR) and non-executable memory, an attacker can convert this memory corruption into reliable code execution. The impact scope covers confidentiality, integrity, and availability of the target device.
Root Cause
The root cause is insufficient bounds validation on attacker-controlled length or content fields within MQTT protocol messages processed by the lwIP client [CWE-787]. Length fields sourced from the network are trusted without cross-checking against destination buffer sizes prior to a memory copy operation. This permits a linear write past the end of a buffer allocated in the network processing path.
Attack Vector
The attack originates from the network and requires no authentication or user interaction. An attacker positioned to act as, or influence traffic from, an MQTT broker that a vulnerable client connects to can deliver a crafted CONNACK, PUBLISH, or SUBACK message. Man-in-the-middle attackers on the same network segment can also inject traffic if TLS is not enforced. Successful exploitation yields arbitrary code execution in the context of the network stack, which on most embedded devices runs with full system privileges.
No verified public proof-of-concept exploit code is available at publication. Consult CISA ICS Advisory ICSA-26-265-01 and the lwIP project page for authoritative technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-87121
Indicators of Compromise
- Unexpected crashes, watchdog resets, or reboots on devices running the lwIP MQTT client shortly after receiving broker traffic
- Outbound MQTT connections from embedded devices to unfamiliar or unauthorized broker endpoints
- Anomalous outbound traffic (reverse shells, TFTP transfers, or beaconing) originating from IoT or Operational Technology (OT) assets
Detection Strategies
- Inspect MQTT traffic for malformed CONNACK, PUBLISH, and SUBACK packets with oversized length fields or inconsistent remaining-length headers
- Build asset inventories that identify firmware images embedding vulnerable lwIP versions using Software Bill of Materials (SBOM) data
- Correlate MQTT session anomalies with subsequent process or network behavior changes on the same host
Monitoring Recommendations
- Baseline MQTT broker destinations for each embedded device and alert on new or external endpoints
- Forward network telemetry from OT segments to a centralized data lake for retention and hunting
- Monitor firewall and IDS logs for MQTT traffic (TCP ports 1883 and 8883) crossing trust boundaries
How to Mitigate CVE-2026-87121
Immediate Actions Required
- Identify all firmware and devices linking against the lwIP MQTT client using SBOM and vendor advisories
- Segment OT and IoT devices onto isolated VLANs and block MQTT traffic from untrusted networks
- Require Transport Layer Security (TLS) and mutual authentication for all MQTT client-broker sessions
- Contact device vendors for firmware updates that incorporate the lwIP fix
Patch Information
Refer to the lwIP project page for the upstream source repository and remediation status. Downstream device vendors must integrate the corrected lwIP MQTT client into new firmware releases. Consult CISA ICS Advisory ICSA-26-265-01 and the CSAF advisory file for the current list of vendor patch releases.
Workarounds
- Disable the MQTT client on devices where the feature is not required
- Restrict outbound MQTT connections to a hardened, allow-listed broker using firewall rules
- Deploy a TLS-terminating MQTT proxy that validates protocol conformance before forwarding traffic to constrained clients
- Enforce strict network segmentation between IT and OT environments per IEC 62443 zone and conduit guidance
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
