The flaw is a classic buffer overflow in the lwIP SMTP client within Savannah. Unsanitized input sizes allow an attacker to overwrite memory on the stack, potentially executing arbitrary code. The weakness is a classic CWE‑120 violation, designed to give attackers a high‑impact compromise of confidentiality, integrity, and availability in systems that process SMTP commands.

Savannah:lwIP SMTP client, no specific version information provided but all versions running the vulnerable SMTP client are affected.

The CVSS score of 9.3 classifies this as critical. The EPSS score is not available, so the likelihood of exploitation cannot be quantified from public data, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be from SMTP traffic; any system that accepts SMTP commands from an external source could potentially be targeted if the attacker can craft a malicious message.