lwIP TCP/IP Stack Double-Free Flaw Risks Code Execution

CVE-2026-91018 (CVSS 8.8) is a double-free vulnerability in lwIP (Lightweight IP), a widely used embedded TCP/IP stack, affecting API versions 2.0.1 through 2.2.1.

Successful exploitation could cause a system crash, a denial-of-service condition, or memory corruption that leads to code execution. Since lwIP is embedded in many IoT and OT devices across multiple critical infrastructure sectors, affected vendors should check for and apply upstream fixes.