Veille CVE

Septembre 2026

3 CVE

Critique 1 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « lwIP » ✕
  1. CVE-2026-74222 8.2 Élevée

    u-boot

    U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to access released memory and crash the bootloader.

  2. CVE-2026-91018 8.8 Élevée

    lwIP API

    lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.

  3. CVE-2026-87121 9.8 Critique

    lwIP TCP/IP Stack MQTT

    lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.