CISA 2026-10-06

Savannah lwIP SMTP client

CVE-2026-15340

Machine-generated analysis · WAYSCloud LLM

The advisory reports a buffer overflow in Savannah lwIP SMTP client 2.2.1. A patch (patch_125_smtp_txbuf.diff) has been released.

Context

Savannah lwIP SMTP client version 2.2.1 is the affected product. The advisory states the client does not validate input size, leading to a classic buffer overflow that could crash the device or allow remote code execution. The advisory notes the product is used in Energy and Water sectors and is deployed worldwide.

Operator considerations

Check: Verify that any Savannah lwIP SMTP client is not version 2.2.1 or is patched.
Patch: Apply the patch_125_smtp_txbuf.diff (git commit 614420f8…) to remediate CVE-2026-15340.
Isolate: Restrict network access to the SMTP client so it is not reachable from the internet.
Log: Monitor for unexpected process crashes or anomalous SMTP traffic that could indicate exploitation attempts.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution.

The following versions of Savannah lwIP SMTP client are affected:

lwIP SMTP client 2.2.1 (CVE-2026-15340)

Vendor

Equipment

Savannah

lwIP SMTP client

1 Vulnerability

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Critical Infrastructure Sectors: Energy, Water and Wastewater Systems

Countries/Areas Deployed: Worldwide

Company Headquarters Location: Sweden

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

Read More

1 Affected Product

Savannah lwIP SMTP client: 2.2.1

Mitigationxchglabs reports that the vulnerability was fixed and released in the following patch: patch_125_smtp_txbuf.diff . This is available as available as git commit (614420f82c8729d070e01464c0dddb...

Read the full advisory on CISA →