All vulnerabilities
CVE-2026-6232

Out-of-bounds write in LR11xx Transceiver

Semtech LR1110 Transceiver
Open in ThreatlineRecord JSON
CVSS
5.2Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0x0403Also 2.1.1, 0x0203 and 1 moreCVE List
Published12 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.

Text from CVE List

Affected versions 8

  • LR1110 Transceiveraffected: all versions before 0x0403CVE List
  • LR1110 Transceiverunaffected: A1_0303CVE List
  • LR1110 Modem-eaffected: all versions before 2.1.1CVE List
  • LR1120 Transceiveraffected: all versions before 0x0203CVE List
  • LR1120 Transceiverunaffected: A2_0101CVE List
  • LR1121 Transceiveraffected: all versions before 0x0105CVE List
  • LR1121 Transceiverunaffected: A3_0101CVE List
  • LR1121 Modem-eaffected: all versions before 2.1.1CVE List

References 1