{"id":"CVE-2026-7764","title":"An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an unauthenticated attacker within radio range to disclose a small amount of kernel heap m…","summary":"An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an unauthenticated attacker within radio range to disclose a small amount of kernel heap m…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":["CWE-125"],"vendor":"morsemicro","product":"halowlink_2_firmware","affected":["halowlink_2_firmware < 2.11.12"],"patched":["halowlink_2_firmware 2.11.12"],"published":"2026-06-04","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7764","references":[{"url":"https://www.morsemicro.com/security-advisories/MM-SA-2026-003","label":"4ac701fe-44e9-4bcd-9585-dd6449257611"}],"tags":["nvd"],"epss":0.0013,"epssPercentile":0.03031,"ingestedAt":"2026-07-01T09:50:45.937Z","slug":"CVE-2026-7764","body":"## Overview\n\nAn out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an unauthenticated attacker within radio range to disclose a small amount of kernel heap memory or cause a Denial of Service (kernel oops/panic) via a crafted 802.11ah beacon or probe response frame containing a malformed Vendor Information Element. The function morse_vendor_find_vendor_ie() does not validate the IE length against the expected structure size before its result is passed to morse_vendor_rx_caps_ops_ie() and morse_vendor_fill_sta_vendor_info(), which read at fixed offsets into the IE data. Because the length check only requires the IE to be longer than 3 bytes, an attacker can supply an undersized IE, causing a heap out-of-bounds read of up to 9 bytes. No authentication, association, or user interaction is required.\n\n## Affected\n\n- `halowlink_2_firmware < 2.11.12`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `halowlink_2_firmware 2.11.12`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}