CVE-2026-6232
Out-of-bounds write in LR11xx Transceiver
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.
| CWE | CWE-787 |
| Vendor | semtech |
| Product | lr1110 transceiver |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for semtech lr1110 transceiver
Be the first to know when new unknown vulnerabilities affecting semtech lr1110 transceiver are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Semtech / LR1110 Transceiver
0 < 0x0403
Semtech / LR1110 Modem-e
0 < 2.1.1
Semtech / LR1120 Transceiver
0 < 0x0203
Semtech / LR1121 Transceiver
0 < 0x0105
Semtech / LR1121 Modem-e
0 < 2.1.1
References
Credits
Egor (radioegor146) Koleda, https://github.com/radioegor146