The U.S. Cybersecurity and Infrastructure Security Agency has warned that Savannah lwIP SMTP client version 2.2.1 contains a critical buffer-overflow vulnerability that could crash an affected device and may permit remote code execution. CISA published its advisory on October 6, 2026, identifying the issue as CVE-2026-15340. The release is listed as known affected in CISA’s advisory.
The vulnerability is in the client’s handling of input. CISA describes a failure to check the size of input before copying data, a weakness classified as CWE-120, or a classic buffer overflow. The agency says successful exploitation could crash the device being accessed. The same condition may allow an attacker to execute code remotely.
The vulnerability has a CVSS version 3.1 base score of 9.8, rated critical. Its published vector describes network-based exploitation with low complexity, no required privileges and no user interaction. The score also reflects potential impacts on confidentiality, integrity and availability. CISA lists a CVSS version 4.0 score of 9.3, also rated critical, with the same broad impact assessment.
The advisory associates the product with energy, water and wastewater systems and says deployments may exist worldwide. It lists Savannah’s headquarters location as Sweden. The sector and geographic information indicate that operators of industrial and other control-system environments may need to check whether the client is present in their networks or embedded in connected devices.
Organizations responsible for systems using the affected client should determine whether version 2.2.1 is deployed. They should then assess the operational effect of applying the available fix before making changes to production systems. The advisory identifies a patch named patch_125_smtp_txbuf.diff as the remediation reported by xchglabs. The change is also available through Git commit 614420f82c8729d070e01464c0dddb3c9525c772.
CISA says xchglabs reported the vulnerability directly to Savannah and that the issue was disclosed after the fix was released. Maintainers can use the named patch or commit to identify the code change and evaluate how it applies to their deployments. Organizations should conduct the required impact analysis and risk assessment before deploying defensive measures or modifying control-system software.
CISA recommends reducing network exposure for control-system devices and other systems that use the client. Devices and systems should not be accessible directly from the internet. The agency also recommends placing control-system networks and remote devices behind firewalls and isolating them from business networks. These measures are intended to reduce the paths available to an attacker while organizations evaluate affected installations and apply remediation.
When remote access is required, CISA recommends more secure methods such as virtual private networks. The agency notes that a VPN is only as secure as the connected devices and advises keeping VPN software updated to the most current version available. Network isolation and access controls should be considered alongside, rather than as a replacement for, applying the software fix where it can be safely deployed.
CISA encourages organizations to implement cybersecurity strategies for industrial control systems, including defense-in-depth measures. Its control-systems guidance also includes material on targeted cyber-intrusion detection and mitigation. Organizations that observe suspected malicious activity should follow established internal procedures and report their findings to CISA for tracking and correlation.
The advisory does not change the affected-version listing: Savannah lwIP SMTP client 2.2.1 is the version identified as affected. Confirming whether that release is deployed, locating exposed instances and evaluating the available patch are the immediate steps for organizations responsible for systems that use it.