Savannah lwIP SMTP client

A critical buffer overflow vulnerability (CVE-2026-15340) has been identified in Savannah lwIP SMTP client version 2.2.1. The flaw exists because the software does not check the size of inputs, potentially allowing a classic buffer overflow condition. Successful exploitation could crash the affected device or allow remote code execution. The vulnerability has a CVSS v3.1 score of 9.8 (CRITICAL) and a CVSS v4.0 score of 9.3 (CRITICAL), with a network-based attack vector requiring no privileges or user interaction. Affected critical infrastructure sectors include Energy, Water and Wastewater Systems, with worldwide deployment. A fix has been released by xchglabs as patch_125_smtp_txbuf.diff, available via git commit 614420f82c8729d070e01464c0dddb3c9525c772. CISA recommends minimizing network exposure, using firewalls, and employing VPNs for remote access as defensive measures.