CVE-2026-6232 — Out-of-bounds write in LR11xx Transceiver

Description (CNA)

An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.

Affected (CNA)

Vendor / product	Versions
Semtech / LR1110 Transceiver	affected 0 before 0x0403; unaffected A1_0303
Semtech / LR1110 Modem-e	affected 0 before 2.1.1
Semtech / LR1120 Transceiver	affected 0 before 0x0203; unaffected A2_0101
Semtech / LR1121 Transceiver	affected 0 before 0x0105; unaffected A3_0101
Semtech / LR1121 Modem-e	affected 0 before 2.1.1

CWE

CWE-787

References

https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-002-lr11xx-security-advisory

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.