noindex and left out of the sitemap until more data is confirmed.CVE-2026-15340 is a classic buffer overflow in the SMTP client of lwIP, the open-source TCP/IP stack embedded in many Internet-connected devices: the client does not check input sizes before copying into a buffer, so a crafted SMTP interaction can crash the device or enable remote code execution; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.4%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-09
Published
Vulnerability ID: CVE-2026-15340 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| lwIP SMTP client | — | 2.2.1 (patched by patch_125_smtp_txbuf.diff, git commit 614420f82c8729d070e01464c0dddb3c9579c772); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-15340 is a buffer copy without checking the size of input (CWE-120, classic buffer overflow) in the SMTP client of lwIP, a widely embedded open-source lightweight TCP/IP stack used across energy and water-sector equipment. CISA's advisory states "lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow," and that "successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution" (CISA ICS Advisory ICSA-26-279-02).
NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-27: it records a CNA-submitted (ICS-CERT) CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 9.3 (critical), but NVD has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting the CNA figure as NVD-confirmed (NVD).
CISA's advisory ICSA-26-279-02, published 2026-10-06, states the flaw affects lwIP SMTP client version 2.2.1 and is fixed by a patch identified as patch_125_smtp_txbuf.diff (git commit 614420f82c8729d070e01464c0dddb3c9579c772). The report came directly from the researcher group xchglabs to the lwIP project (hosted on GNU Savannah), which disclosed the issue after releasing the fix. CISA lists the energy and water/wastewater sectors as affected, with worldwide deployment, and states no known public exploitation has been reported to it at this time (CISA ICS Advisory ICSA-26-279-02).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-26, and FIRST scores the probability of exploitation at 0.00367 (30.3rd percentile) as of 2026-10-26 (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, devices embedding lwIP's SMTP client should apply the upstream patch (or upgrade to a release that includes it), since the component is typically vendored into firmware rather than updated independently.
Evidence
- lwIP's SMTP client does not check input sizes before a buffer copy, risking a device crash or remote code execution via a crafted SMTP interaction (CWE-120). — CISA ICS Advisory ICSA-26-279-02
- NVD status is "Awaiting Analysis" with a CNA (ICS-CERT) submitted CVSS v3.1 9.8 / v4.0 9.3, no NVD-published score or CPE configuration as of 2026-10-27. — NVD
- Affects lwIP SMTP client 2.2.1, fixed by patch_125_smtp_txbuf.diff (commit 614420f82c8729d070e01464c0dddb3c9579c772); reported by xchglabs; no known public exploitation reported; energy and water/wastewater sectors affected worldwide. — CISA ICS Advisory ICSA-26-279-02
- Not present in the CISA KEV catalog as of 2026-10-26. — CISA KEV
- EPSS score is 0.00367 (30.3rd percentile) as of 2026-10-26. — FIRST EPSS
