1. Executive summary
CISA has published an ICS advisory for a double free vulnerability, CVE-2026-91018, in the lwIP (Lightweight IP) embedded TCP/IP stack, affecting API versions 2.0.1 through 2.2.1. The flaw is rated CVSS v3.1 8.8 HIGH (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 8.7 HIGH, with an adjacent-network attack vector and no privileges or user interaction required. Successful exploitation can crash the system, cause denial of service, corrupt memory, or lead to code execution on the victim device. CISA states there is no known public exploitation targeting this vulnerability at this time and that it is not exploitable remotely. lwIP ships inside firmware across the critical infrastructure sectors CISA lists, including Financial Services, so the exposure for EMEA clients runs through embedded devices (payment terminals, network equipment, building and data-centre infrastructure) rather than server estates.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The advisory describes a vulnerability in an upstream open-source component with no reported exploitation and no incident at any named entity; the generic fact that patching may be required does not on its own trigger the articles in the regulatory reference. Clients that identify affected lwIP-based devices in their OT or payment-hardware estate should treat discovery and remediation under their existing ICT risk processes.
3. Technical analysis & attack chain
CVE-2026-91018 is a double free (CWE-415) in lwIP, the Lightweight IP stack maintained by the Swedish-hosted open-source project and distributed worldwide. Affected versions are lwIP API >=2.0.1 through <=2.2.1. A double free occurs when the same allocated memory block is released twice; the second free corrupts the allocator's internal state, which can crash the process, cause a denial of service, or, in the worst case, let an attacker manipulate heap metadata to achieve memory corruption and code execution. CISA's impact statement lists all four outcomes: system crash, DoS, memory corruption, and code execution on the victim system.
The attack vector is adjacent-network (AV:A in both the v3.1 and v4.0 vectors), meaning the attacker must be able to reach the device on the same network segment or otherwise bypass routing separation; CISA explicitly states the vulnerability is not exploitable remotely over the internet. No privileges (PR:N) and no user interaction (UI:N) are required, so any peer on the reachable network segment is a viable attacker. Confidentiality, integrity, and availability impacts are all high (C:H/I:H/A:H), which is consistent with the code-execution outcome on an embedded target where the stack typically runs with full device privileges.
No exploit steps, proof-of-concept code, or observed exploitation are described in the advisory, so no confirmed attack chain can be reconstructed. The vulnerability was reported to CISA by Eric Evenchick of Tetrel Security. A companion advisory published the same day, ICSA-26-265-01, covers a separate out-of-bounds write (CWE-787) in the lwIP TCP/IP Stack MQTT Client Application, rated CVSS v3.1 9.8 CRITICAL with a network attack vector, fixed in commit f89407ea711879c04d91c92b35d67be78bbaf0f1; clients inventorying for CVE-2026-91018 should inventory for that flaw in the same pass. Both advisories are single-sourced to CISA; no second-party technical analysis or exploit research is available at time of writing.
4. Mitigation & containment
P1 (within 24h): Inventory embedded and network-attached devices for lwIP API versions 2.0.1 through 2.2.1. Priority targets are devices on operational, branch, and payment networks: payment terminals, printers, cameras, PLCs, gateways, and any firmware whose SBOM lists lwIP. Where a device SBOM is unavailable, query the device vendor for lwIP inclusion and version; lwIP is statically linked, so it will not appear in OS package inventories.
P2 (within 72h): For source-built products, update lwIP to a version containing commit f873b6295933e4149a2132adf3e9a2d2a676a5ec from the upstream repository (https://cgit.git.gnu.org/cgit/lwip.git, mirrored at https://cgit.git.savannah.gnu.org/cgit/lwip.git) and rebuild. For vendor firmware, track the vendor's patch cycle; there is no vendor fix named in the advisory beyond the upstream commit. In parallel, apply CISA's recommended controls for the adjacent-network exposure: firewall segmentation between device networks and corporate networks, no internet exposure for control system devices, and VPN with current patching where remote access is required.
P3 (within 7 days): Extend the same inventory to the companion flaw in ICSA-26-265-01 (lwIP MQTT Client Application out-of-bounds write, CVSS 9.8, network vector, fixed in commit f89407ea711879c04d91c92b35d67be78bbaf0f1); the MQTT flaw is the more exposed of the two because it does not require adjacency. Add lwIP version disclosure to third-party procurement and firmware intake checks so affected versions are caught before deployment. Where a device cannot be patched, document the compensating segmentation controls and the residual risk.
5. Indicators of compromise
No indicators of compromise available in the source material. The advisory describes a vulnerability with no observed exploitation and provides no hashes, network indicators, or behavioural artefacts.
6. Detection
Insufficient indicators to author detection rules. The advisory contains no exploit artefacts, strings, file paths, or network signatures; the only actionable identifiers are the CVE number and the upstream fix commit, which are reporting metadata rather than threat artefacts. Detection effort is better spent on the inventory and segmentation actions in §4.
7. Sources
- CISA, "lwIP (Lightweight IP)", ICS Advisory ICSA-26-265-02, https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-02, 2026-09-22
- CISA, "lwIP TCP/IP Stack MQTT Client Application", ICS Advisory ICSA-26-265-01, https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-01, 2026-09-22
8. Adverse Trace position
We assess this as a high-severity vulnerability with currently low exploitability: the CVSS 8.8 rating is driven by the code-execution potential, but the adjacent-network constraint, the absence of any reported exploitation, and the difficulty of weaponising a double free in a statically linked embedded stack all limit near-term risk. The realistic exposure for EMEA financial services is concentrated in payment terminals, branch-office embedded devices, and data-centre management hardware, and the binding constraint is visibility: most clients cannot currently name which firmware images in their estate contain lwIP 2.0.1 to 2.2.1. We treat the technical detail as single-sourced to CISA and will not treat exploit availability as confirmed until a second source corroborates it. We will monitor for proof-of-concept code, for KEV listing, and for vendor advisories naming affected firmware, and we will reissue this note if exploitation is observed or if the companion MQTT flaw (CVSS 9.8, network-reachable) is confirmed in the same product lines.
Published via PulseTrace — Adverse Trace threat intelligence.