---
id: CVE-2026-6232
title: >-
  An out-of-bounds write vulnerability in the SPI host command interface of
  Semtech's LR11xx transceiver firmware where a crafted SPI host command with an
  oversized length field can cause the firmware to write up to 254 arbitrary
  bytes pas…
summary: >-
  An out-of-bounds write vulnerability in the SPI host command interface of
  Semtech's LR11xx transceiver firmware where a crafted SPI host command with an
  oversized length field can cause the firmware to write up to 254 arbitrary
  bytes pas…
severity: none
cwe:
  - CWE-787
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:17:23.333'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6232'
references:
  - url: >-
      https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-002-lr11xx-security-advisory
    label: security@sierrawireless.com
tags:
  - nvd
ingestedAt: '2026-10-12T19:01:57.228Z'
---

## Overview

An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.