Savannah lwIP SMTP Client 2.2.1: Critical 9.8 Buffer Overflow Fixed
CISA advisory ICSA-26-279-02 flags CVE-2026-15340 in Savannah lwIP SMTP client 2.2.1, a critical 9.8 buffer overflow fixed by a released patch and git commit.
Savannah’s lwIP SMTP client version 2.2.1 carries a critical buffer overflow vulnerability that could crash a device or, worse, let an attacker run code remotely. CISA published the advisory ICSA-26-279-02 on October 6, 2026, tracking the flaw as CVE-2026-15340.
The bug is a classic buffer copy without checking the size of input, classified as CWE-120. In plain terms, the SMTP client does not check the size of inputs, which is what opens the door to the overflow. CISA’s summary states that successful exploitation could crash the device being accessed, and that the buffer overflow condition may allow remote code execution.
The numbers back up the severity. CISA lists a CVSS v3 base score of 9.8 and a CVSS v4 score of 9.3, both rated critical. The v3 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning the attack is network-reachable, low complexity, and needs no privileges or user interaction.
Who is exposed
According to the advisory, the affected product is Savannah lwIP SMTP client 2.2.1, with product status listed as known_affected. CISA places the deployment in the Energy and Water and Wastewater Systems critical infrastructure sectors, and says the affected countries and areas are worldwide. Savannah’s company headquarters location is listed as Sweden.
The fix is already out
xchglabs reported the vulnerability directly to Savannah and disclosed it once the fix was released, according to the advisory. The same reporter notes that the issue was fixed and released as patch_125_smtp_txbuf.diff, available as git commit 614420f82c8729d070e01464c0dddb3c9525c772.
If you run lwIP SMTP client 2.2.1 in a control system environment, that commit is the practical starting point. CISA’s recommended practices go further: minimize network exposure for all control system devices so they are not accessible from the internet, place control system networks and remote devices behind firewalls and isolate them from business networks, and use VPNs when remote access is required, keeping them updated.
CISA also reminds organizations to perform proper impact analysis and risk assessment before deploying defensive measures, and to report suspected malicious activity through established internal procedures so it can be tracked and correlated.
Sources
- Savannah lwIP SMTP client — CISA Advisories
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
