CVE-2026-6232
5.2MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity, availability
- Weakness
- CWE-787
Impact
Attackers can corrupt memory and potentially crash or modify transceiver operation. They need physical access to the device and logical access to the SPI bus to send crafted host commands.
Root cause
The SPI host command interface accepts an oversized length field, causing an out-of-bounds write of up to 254 bytes past a non-persistent internal buffer.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X
Fix & remediation
Check the Semtech advisory (sem-psa-2026-002) for the fixed firmware image, and restrict physical access or tamper-proof the device hardware to prevent unauthorized SPI bus access in the interim.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.