CVE-2026-91018: lwIP Double Free Buffer Overflow Vulnerability

CVE-2026-91018 Overview

CVE-2026-91018 is a double free vulnerability [CWE-415] in lwIP (Lightweight IP), an open-source TCP/IP stack widely used in embedded systems and industrial control system (ICS) devices. An attacker on an adjacent network can trigger the flaw to crash the system, cause a denial of service (DoS), corrupt memory, or potentially execute arbitrary code on the victim device. The vulnerability is documented in CISA ICS Advisory ICSA-26-265-02 and impacts operational technology (OT) environments where lwIP is embedded in networked devices.

Critical Impact
Adjacent-network attackers can crash lwIP-based devices or achieve memory corruption that may lead to arbitrary code execution on embedded and ICS systems.

Affected Products

lwIP (Lightweight IP) TCP/IP stack — see the GNU lwIP Git Repository
Embedded and IoT devices linking the affected lwIP library
Industrial control system devices identified in CISA ICSA-26-265-02

Discovery Timeline

2026-09-22 - CVE-2026-91018 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91018

Vulnerability Analysis

The flaw is a double free condition [CWE-415] in the lwIP TCP/IP stack. A double free occurs when the same memory region is released twice through the allocator, corrupting heap metadata and freelist structures. In lwIP, this behavior can be triggered by crafted network input processed by the stack's packet buffer (pbuf) or connection management routines.

On embedded targets, the consequences range from an immediate crash and denial of service to controlled heap corruption. Because lwIP typically runs without memory protection between tasks on microcontrollers, corrupted allocator state can be leveraged to overwrite adjacent structures. In favorable conditions, attackers can pivot heap corruption into arbitrary code execution within the device firmware.

Root Cause

The root cause is inconsistent ownership tracking of dynamically allocated buffers within lwIP. A code path releases a buffer, and a subsequent path calls the free routine on the same pointer without clearing the reference. Under the CWE-415 pattern, the second free corrupts heap bookkeeping used by future allocations.

Attack Vector

The attack vector is Adjacent Network, meaning the attacker must reach the target on the same layer-2 broadcast domain, such as a shared Ethernet segment, Wi-Fi network, or routed OT VLAN. No authentication or user interaction is required. Exploitation requires sending specifically crafted network traffic that reaches the vulnerable code path in the lwIP stack.

No verified proof-of-concept exploit code is publicly available at time of writing. Refer to the CISA CSAF Threat Report for structured advisory data.

Detection Methods for CVE-2026-91018

Indicators of Compromise

Unexpected reboots, watchdog resets, or crash loops on embedded devices running lwIP
Malformed or fragmented TCP/IP packets targeting device management interfaces from adjacent hosts
Loss of network responsiveness on OT devices followed by firmware restart events

Detection Strategies

Monitor OT network segments for protocol anomalies and malformed packets directed at embedded devices
Correlate device crash and reboot telemetry with adjacent-network traffic captures to identify triggering flows
Deploy network intrusion detection signatures once vendor-specific advisories publish packet-level indicators

Monitoring Recommendations

Enable syslog or SNMP trap forwarding from ICS devices to a centralized log platform for crash event correlation
Baseline expected TCP/IP traffic per device and alert on new sources on the adjacent segment
Track EPSS scoring for CVE-2026-91018, currently 0.241% (percentile 13.483), to detect rising exploitation likelihood

How to Mitigate CVE-2026-91018

Immediate Actions Required

Inventory devices linking the lwIP stack across OT and IoT environments using CISA ICSA-26-265-02 as a reference
Contact device vendors for firmware updates that incorporate the corrected lwIP source from the upstream repository
Restrict adjacent-network access to affected devices using VLAN segmentation and strict access control lists

Patch Information

Apply firmware updates from device vendors that integrate the patched lwIP source. Track fixes upstream through the GNU lwIP Git Repository and follow guidance in CISA ICS Advisory ICSA-26-265-02 for product-specific remediation timelines.

Workarounds

Isolate affected devices on dedicated management VLANs with no direct user access
Block untrusted hosts from reaching device network interfaces using layer-2 filtering and port security
Disable unused network services and protocols on affected devices to reduce reachable attack surface
Deploy an OT-aware firewall between engineering workstations and vulnerable field devices