CVE-2026-6232

MediumCVSS 5.2/10Last modified Oct 16, 2026

Description

An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.

Metrics

CVSS 4.0 5.2/10

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Semtech	LR1110 Transceiver	< 0x0403
Semtech	LR1110 Modem-e	< 2.1.1
Semtech	LR1120 Transceiver	< 0x0203
Semtech	LR1121 Transceiver	< 0x0105
Semtech	LR1121 Modem-e	< 2.1.1

References

https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-002-lr11xx-security-advisory

Timeline

Published: Oct 12, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-623226.5Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code witho CVE-2026-623236.3Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a CVE-2026-623245.4Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to CVE-2026-623259.1goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go passw CVE-2026-623266.5Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the b CVE-2026-623279.19Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve pla CVE-2026-623287.59Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensit CVE-2026-623318.2praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1 CVE-2026-623338.7OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.CVE-2026-623348.7OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.CVE-2026-623356.9OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.CVE-2026-623376.9SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point