CVE-2026-15340: Savannah Lwip Smtp Client

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

Affected products

• Savannah Lwip Smtp Client: version 2.2.1 only

Published 2026-10-09. Last modified 2026-10-09.