{"id":"CVE-2026-89142","title":"Out-of-bounds Write in Wi-Fi NPU","summary":"In the Wi-Fi NPU FW, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local denial of service with user execution privileges needed. User interaction is not needed for exploitation.","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Airoha Technology Corp.","product":"EN7529, AN7552, AN7581, AN7583 (Wi-Fi NPU Firmware)","affected":["en7529_an7552_an7581_an7583_wi-fi_npu_firmware <= TLB7.8.0.0_v006"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T12:04:29.739Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89142","references":[{"url":"https://www.airoha.com/product-security-bulletin#CVE-2026-89142"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T04:44:51.983Z","epss":0.00225,"epssPercentile":0.13267,"slug":"CVE-2026-89142","body":"## Overview\n\nIn the Wi-Fi NPU FW, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local denial of service with user execution privileges needed. User interaction is not needed for exploitation.\n\n## Affected\n\n- `en7529_an7552_an7581_an7583_wi-fi_npu_firmware <= TLB7.8.0.0_v006`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}