lwIP versions up to 2.2.1 contain a stack buffer overflow in the mDNS search response handler. An attacker on the same local network can send specially crafted multicast PTR or SRV DNS answers whose RDLENGTH fields are invalid, causing the 256‑byte stack buffer to be overwritten. This overflow corrupts adjacent stack memory, which may crash the device and interrupt services. The vulnerability is an out‑of‑bounds write (CWE‑121) that does not provide remote code execution but can disrupt availability for the target.

All lwIP 2.2.1 and earlier implementations are affected. This includes embedded systems, IoT devices, routers, and other network appliances running the lwIP TCP/IP stack that enable mDNS service discovery. The flaw resides in the mdns.c source file of the lwIP project, and the vulnerability applies to any build that includes this code.

The CVSS base score is 6, indicating a moderate severity. No EPSS data is available, so the exploitation probability is uncertain, but the flaw is local and simple to trigger. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires only local network traffic, the risk is confined to compromised LAN segments. An attacker can easily craft and send the malicious mDNS packets using standard tools or scripts. There are no authentication or privilege checks before processing the responses, so any device on the link can exploit it.