---
id: CVE-2026-6232
title: >-
  An out-of-bounds write vulnerability in the SPI host command interface of
  Semtech's LR11xx transceiver firmware where a crafted SPI host command with an
  oversized length field can cause the firmware to write up to 254 arbitrary
  bytes pas…
summary: >-
  An out-of-bounds write vulnerability in the SPI host command interface of
  Semtech's LR11xx transceiver firmware where a crafted SPI host command with an
  oversized length field can cause the firmware to write up to 254 arbitrary
  bytes pas…
severity: medium
cvss: 5.2
cvssVector: 'CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/RE:M'
cwe:
  - CWE-787
vendor: Semtech
product: LR1110 Transceiver
affected:
  - lr1110_transceiver < 0x0403
  - lr1110_modem-e < 2.1.1
  - lr1120_transceiver < 0x0203
  - lr1121_transceiver < 0x0105
  - lr1121_modem-e < 2.1.1
published: '2026-10-12'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:56:15.773'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6232'
references:
  - url: >-
      https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-002-lr11xx-security-advisory
    label: security@sierrawireless.com
tags:
  - nvd
  - cve.org
epss: 0.00167
epssPercentile: 0.05876
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T17:57:51.146102Z'
cvssSource: cna
ingestedAt: '2026-10-12T19:01:57.228Z'
---

## Overview

An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.