VulnSocial

CVE-2026-91018Disclosure

LOWCVSS 8.7 · HIGH

Exploitation ongoing with high activity in latest observed window (3 mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-415

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • Active exploitation appears in 1 classified signals
  • 3 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-09-22: 3Active Exploitation · 2026-09-22: 1Technical Details · 2026-09-22: 309-22
Signal classification2 categories
Disclosure
266.7%
Active Exploitation
133.3%
Referenced assets2 URLs
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-91018 lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system. https://www.cve.org/CVERecord?id=CVE-2026-91018

    Post summary

    The text announces CVE-2026-91018 in lwIP, detailing a double-free vulnerability with high-severity impacts including DoS and potential code execution, linking to the official CVE record without mentioning patches or exploits.

    00001816
    58.1K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploiting CVE-2026-91018 double free vulnerability in lwIP to gain initial access to critical infrastructure systems. Memory corruption enables privilege escalation and lateral movement across unencrypted OT networks. Runtime segmentation helps contain post-compromise activity in industrial environments. #CloudSecurity 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/lwip-double-free-vulnerability-cve-2026-91018-ics

    Post summary

    Attackers are actively exploiting CVE‑2026‑91018, a double‑free bug in lwIP, to gain initial access and move laterally in critical infrastructure and OT networks; no patch or mitigation guidance is provided.

    0000042
    2.0K followersView on X
  • NewsTongue@NewsTongueX
    Disclosure

    🔴 Double-free vulnerability in lwIP affects critical infrastructure worldwide A double-free vulnerability in lwIP (Lightweight IP) API versions 2.0.1 through 2.2.1 can crash systems, cause denial of service, corrupt memory, or enable code execution. The flaw (CVE-2026-91018) affects deployments across chemical, energy, financial services, healthcare, transportation, and water systems globally. lwIP is developed in Sweden. Eric Evenchick of Tetrel Security reported the vulnerability to CISA. No public exploitation has been reported.

    Post summary

    The text announces a double-free vulnerability in lwIP (CVE-2026-91018) affecting critical infrastructure sectors, detailing the affected versions and potential impacts, while explicitly noting no public exploitation has been reported and without mentioning any patches or PoCs.

    0000060
    926 followersView on X

Explore more

Back to dashboard