Critical Buffer Overflow Flaw Found in Savannah lwIP SMTP Client

The National Vulnerability Database has published a record for CVE-2026-15340, a critical security vulnerability affecting the Savannah lwIP SMTP client. The flaw allows for potential buffer overflow attacks due to insufficient input validation.

The vulnerability carries a CVSS score of 9.8, placing it in the Critical severity range. According to the NVD record, the underlying weakness is classified as CWE-120, which relates to buffer errors. Specifically, the lwIP SMTP client does not check the size of inputs before processing them. This lack of validation creates a condition where an attacker can potentially overflow the buffer, leading to memory corruption and possible code execution. The issue is present in Savannah lwIP SMTP client version 2.2.1.

Context and Background

lwIP (Lightweight IP) is a small implementation of the TCP/IP protocol suite, often used in embedded systems and IoT devices due to its low memory footprint. The SMTP client component within this stack handles email transmission. When networked components like SMTP clients process external data, strict input validation is essential to prevent buffer overflows.

CWE-120 describes a class of errors where software copies data into a buffer without ensuring the buffer is large enough to hold the data. In this specific case, the failure to check input sizes in version 2.2.1 exposes the system to these risks. The assignment of a 9.8 CVSS score indicates that the vulnerability is easily exploitable and could result in a complete loss of confidentiality, integrity, and availability.

Who is Affected

According to the NVD record, the specific affected product is the Savannah lwIP SMTP client, version 2.2.1. Organizations or developers utilizing this specific version of the lightweight IP stack for email functionality in their embedded devices or applications are at risk. The vulnerability is inherent in the software code of this release, meaning any deployment using this exact version is potentially vulnerable to exploitation. There is no mention of other versions or forks in the provided source material, so the scope is limited to this specific identifier.

What should you do?

Security teams should audit their embedded systems and IoT devices to determine if they are running Savannah lwIP SMTP client version 2.2.1. If this version is in use, the system is vulnerable to buffer overflow attacks via the SMTP client. Monitor network traffic for unusual SMTP activity that could indicate exploitation attempts. Since no patch or fix has been confirmed yet in the source material, organizations should prepare to apply updates once the vendor provides them. In the interim, limiting network exposure for devices running this component can reduce the attack surface.