ICSA-26-265-02

Critical lwIP Embedded TCP/IP Stack Double Free Flaw Exposes Industrial Controllers to Remote Hijacking CVE-2026-91018

CISA and lwIP maintainers warn of high-severity flaw CVE-2026-91018 in the lwIP TCP/IP stack allowing unauthenticated remote memory corruption across IoT and PLCs.