Out-of-bounds write in LR11xx Transceiver
An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.
CVE-2026-6232
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-6232
LR1110 Transceiver
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
LR1110 Modem-e
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
LR1120 Transceiver
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
LR1121 Transceiver
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
LR1121 Modem-e
Source reference: /containers/cna/affected/4/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Semtech",
"product": "LR1110 Transceiver",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0x0403",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "A1_0303",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Semtech",
"product": "LR1110 Modem-e",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.1.1",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Semtech",
"product": "LR1120 Transceiver",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0x0203",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "A2_0101",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Semtech",
"product": "LR1121 Transceiver",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0x0105",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "A3_0101"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Semtech",
"product": "LR1121 Modem-e",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.1.1",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-6232
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #29995 · Revision 1
- Added to Heist Feed
- Publisher date