{"id":"CVE-2026-6232","title":"An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes pas…","summary":"An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes pas…","severity":"none","cwe":["CWE-787"],"published":"2026-10-12","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:17:23.333","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6232","references":[{"url":"https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-002-lr11xx-security-advisory","label":"security@sierrawireless.com"}],"tags":["nvd"],"ingestedAt":"2026-10-12T19:01:57.228Z","slug":"CVE-2026-6232","body":"## Overview\n\nAn out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}