What’s Vulnerable › Vulnerabilities
CVE-2026-6232: Out-of-bounds write in LR11xx Transceiver
- Severity: medium (CVSS 5.2 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-12 · updated 2026-10-16
- Weakness: CWE-787
Description
An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.
Affected products
- Semtech LR1110 Modem-e: before 2.1.1 — fixed in 2.1.1
- Semtech LR1110 Transceiver: before 0x0403 — fixed in 0x0403
- Semtech LR1120 Transceiver: before 0x0203 — fixed in 0x0203
- Semtech LR1121 Modem-e: before 2.1.1 — fixed in 2.1.1
- Semtech LR1121 Transceiver: before 0x0105 — fixed in 0x0105
How to fix
Upgrade to a fixed version: Semtech LR1110 Modem-e 2.1.1; Semtech LR1110 Transceiver 0x0403; Semtech LR1120 Transceiver 0x0203; Semtech LR1121 Modem-e 2.1.1; Semtech LR1121 Transceiver 0x0105. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-6232 or the next vulnerability affects your stack