This issue is a double free flaw in the lwIP lightweight IP stack. When a packet is processed, the stack can release the same memory region twice, which corrupts heap structures. The corruption can lead to application crashes, denial of service, or provide an escape for arbitrary code execution on the host system.

The vulnerability impacts any system that implements the lwIP API. The description does not specify affected kernel versions, so every build of lwIP compiled before the patch commit may be vulnerable.

The CVSS score of 8.7 indicates a high severity and the flaw is exploitable via remote network traffic that triggers the double free. The EPSS score is not available, so an exact exploitation likelihood cannot be quantified, but given the historical exploitation of double frees, a moderate to high risk is plausible. The vulnerability is not listed in the CISA KEV catalog. Attackers can potentially send malformed packets to the lwIP stack from a remote host, causing a crash or enabling memory corruption that could be leveraged for code execution.