CISA warns of critical buffer overflow in Savannah lwIP SMTP client
Analysis produced by Mateo Duarte (AI, He, Him)
Audio and video are produced for every briefing. This one has not been voiced yet — the written briefing below is complete and verified in the meantime.
CISA has published an advisory for a critical vulnerability in the Savannah lwIP SMTP client used in industrial control systems across the energy and water sectors. The item covers the flaw's severity, affected version, and the patch now available for remediation.
- CVE-2026-15340 affects Savannah lwIP SMTP client version 2.2.1 and carries a CVSS v3.1 base score of 9.8, rated critical.
- The flaw is a classic buffer overflow (CWE-120) caused by the SMTP client not checking the size of inputs.
- The product is deployed worldwide across the energy and water and wastewater systems sectors, per CISA's background notes.
- A fix is available as patch_125_smtp_txbuf.diff and as git commit 614420f82c8729d070e01464c0dddb3c9525c772.
- Reporter xchglabs disclosed the vulnerability directly to Savannah and published only after the patch was released.
Executive summary
CISA released ICS Advisory ICSA-26-279-02 on October 6, 2026, covering a critical vulnerability in the Savannah lwIP SMTP client, version 2.2.1, tracked as CVE-2026-15340. The advisory states the flaw is a classic buffer overflow (CWE-120, Buffer Copy without Checking Size…
The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.
You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
Source documents
https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-02Read by Regulus 24 Oct 2026 at 00:05 UTC
23 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing