CVE-2026-6232: Out-of-bounds write in LR11xx Transceiver
An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Devices using Semtech LR11xx transceiver firmware are exposed only where an attacker can obtain physical access to the device and logical access to its SPI bus.
What does an attacker need to exploit the vulnerability?
The attacker must send a crafted SPI host command containing an oversized length field. No privileges or user interaction are required according to the supplied CVSS vector, but physical and SPI-bus access are required.
What is the potential impact of a successful exploit?
A crafted command can cause the firmware to write up to 254 arbitrary bytes beyond an internal non-persistent memory buffer. The stated impacts are high integrity and availability impact, with no confidentiality impact listed.