lwIP MQTT Client Out-of-Bounds Write Enables Full Code Execution

CVE-2026-87121 (CVSS 9.8) is an out-of-bounds write vulnerability in the lwIP TCP/IP Stack MQTT Client Application, affecting versions 2.0.1 through 2.2.1.

Successful exploitation could allow an attacker to gain full code execution on the affected device. Given the severity and the stack’s use across critical infrastructure sectors, vendors embedding this component should prioritize the fix.