A Critical Flaw in the MQTT Client Inside a Lot of Firmware
CVE-2026-87121 is an out-of-bounds write in the lwIP MQTT client, versions 2.0.1 through 2.2.1, scored 9.8. The fix is a source commit, which means every downstream vendor has to rebuild.
CISA released ICSA-26-265-01 on 22 September for a single CVE with a wide blast radius. CVE-2026-87121 is an out-of-bounds write (CWE-787) in the MQTT client application shipped with the lwIP TCP/IP stack, affecting versions 2.0.1 through 2.2.1. It scores 9.8 on CVSS v3.1 and 9.3 on v4.0, and CISA's impact statement is explicit: the affected product is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.
Not a crash. Code execution.
lwIP is an open-source TCP/IP stack used across an enormous number of microcontroller-class devices — the kind of part where a full Linux network stack won't fit and the vendor needs something small, free and proven. CISA lists eight affected critical infrastructure sectors: chemical, communications, critical manufacturing, energy, financial services, healthcare and public health, transportation systems, and water and wastewater. Deployment is described as worldwide. Shahriyar Jalayeri of ByteRay reported it.
The remediation is where this differs from a normal advisory. There is no patch to install. The fix is a source commit — f89407ea711879c04d91c92b35d67be78bbaf0f1 in the Savannah repository — which means it reaches a device only when the manufacturer pulls it, rebuilds the firmware, re-tests and ships an update. For a well-run product line that is a few weeks. For a device whose vendor no longer employs the engineer who built the firmware, it is never.
The population at risk is also the population most likely to be exposed. A device that uses the lwIP MQTT client is, almost by definition, a device talking to a broker over the internet. That's the deployment this code exists to support.
For product teams the action is narrow and immediate: check whether your build pins an lwIP release between 2.0.1 and 2.2.1, and whether the MQTT client is compiled into the image at all. Plenty of projects include lwIP and never enable that module, and knowing which case you're in takes one look at your configuration header.