Vulnerability · Published Oct 12, 2026 · Assigned by Semtech
CVE-2026-6232Out-of-bounds write in LR11xx Transceiver
Medium 5.2
In plain English
A medium-severity out-of-bounds write in LR1110 Modem-e from Semtech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Semtech | LR1110 Transceiver | 0 – before 0x0403 |
| Semtech | LR1110 Modem-e | 0 – before 2.1.1 |
| Semtech | LR1120 Transceiver | 0 – before 0x0203 |
| Semtech | LR1121 Transceiver | 0 – before 0x0105 |
| Semtech | LR1121 Modem-e | 0 – before 2.1.1 |
Weakness: CWE-787 · Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/RE:M