CVE-2026-119053
Description
A flaw was found in lwIP. The Simple Network Management Protocol (SNMP) agent contains an out-of-bounds read vulnerability in the snmp_pbuf_stream_writeto() function due to improper buffer bounds calculation during copy operations. A remote unauthenticated attacker with knowledge of the read community string can exploit this flaw by sending crafted, fragmented SNMP requests. Successful exploitation allows the attacker to disclose sensitive information from adjacent buffer or memory pools echoed back in network responses.
Statement
This vulnerability is rated as Moderate severity because, despite being remotely exploitable, the impact is strictly limited to partial information disclosure from memory buffers without allowing modification of data or arbitrary code execution. Red Hat Enterprise Linux core repositories do not distribute standalone lwIP packages, restricting potential exposure to specialized community or third-party packages that embed the library. Furthermore, exploitation requires that the embedded stack is compiled with SNMP agent functionality enabled and depends on the attacker possessing valid read community credentials.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality
Technical Impact: Bypass Protection Mechanism
Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other
Technical Impact: Varies by Context
The read operation could produce other undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
