LwIP (Lightweight IP) (>=2.0.1, <=2.2.1)

The lwIP TCP/IP stack contains a double free vulnerability (CVE-2026-91018) that could allow an attacker with adjacent network access to trigger memory corruption or remote code execution.