CVE-2026-12519

{"id": "CVE-2026-12519", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12519", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T18:21:35.823541Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.6}]}, "affected": [{"source": "vulnerabilities@zephyrproject.org", "affectedData": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "1.13.0", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["drivers/modem/vendor_standalone/wncm14a2a.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}]}], "published": "2026-08-17T17:16:38.867", "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/c516cb7c14f8b0537811764daa94bedc50c230f3", "source": "vulnerabilities@zephyrproject.org"}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8hrc-q8cp-6xhf", "source": "vulnerabilities@zephyrproject.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "vulnerabilities@zephyrproject.org", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a2a.c). The response line is linearized into a fixed 40-byte stack buffer via net_buf_linearize(), which caps the copy at 39 bytes and returns out_len <= 39. The two quote-delimiter scanning loops, however, were bounded by len \u2014 the full CR/LF-delimited frame length returned by net_buf_findcrlf() \u2014 rather than by out_len.\n\nWhen a %NOTIFYEV: line longer than 39 bytes contains no \" within the linearized region, the loop indices p1/p2 walk past value[39] and read adjacent stack memory until a stray quote byte is found or the index reaches len. The over-read string is then passed to strncmp()/atoi()/LOG_*, and if a quote byte is found out of bounds the subsequent value[p2] = '\\0' performs a single-NUL out-of-bounds stack write at an attacker-influenced offset.\n\nThe %NOTIFYEV: payload carries network-derived content (LTIME network time, SIB1 base-station system information, CSPS/RRCSTATE), so a rogue cellular base station, a malicious or compromised modem module, or RF manipulation that induces an over-long notify line reaches the defect without any application interaction; the handler runs automatically on the unsolicited event in the modem RX thread.\n\nThe impact is out-of-bounds stack disclosure (into logs and parsing) and stack corruption that can crash the modem RX thread (denial of service). The write offset is only weakly controlled, so memory-safe code execution is not demonstrated. The fix bounds both scanning loops by out_len, keeping all accesses within the linearized buffer."}, {"lang": "es", "value": "El controlador del m\u00f3dem LTE-M WNC-M14A2A gestiona incorrectamente los eventos %NOTIFYEV: no solicitados en on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a2a.c). La l\u00ednea de respuesta se linealiza en un b\u00fafer de pila fijo de 40 bytes a trav\u00e9s de net_buf_linearize(), que limita la copia a 39 bytes y devuelve out_len menor o igual que 39. Los dos bucles de escaneo de delimitadores de comillas, sin embargo, estaban limitados por len - la longitud completa del marco delimitado por CR/LF devuelta por net_buf_findcrlf() - en lugar de por out_len.\n\nCuando una l\u00ednea %NOTIFYEV: de m\u00e1s de 39 bytes no contiene \u2019 dentro de la regi\u00f3n linealizada, los \u00edndices de bucle p1/p2 superan value[39] y leen memoria de pila adyacente hasta que se encuentra un byte de comilla extraviado o el \u00edndice alcanza len. La cadena sobrele\u00edda se pasa entonces a strncmp()/atoi()/LOG_*, y si se encuentra un byte de comilla fuera de los l\u00edmites, el subsiguiente value[p2] = \u2019\\0\u2019 realiza una escritura de pila fuera de l\u00edmites de un solo NUL en un desplazamiento influenciado por el atacante.\n\nLa carga \u00fatil %NOTIFYEV: transporta contenido derivado de la red (hora de red LTIME, informaci\u00f3n del sistema de estaci\u00f3n base SIB1, CSPS/RRCSTATE), por lo que una estaci\u00f3n base celular maliciosa, un m\u00f3dulo de m\u00f3dem malicioso o comprometido, o manipulaci\u00f3n de RF que induce una l\u00ednea de notificaci\u00f3n excesivamente larga alcanza el defecto sin ninguna interacci\u00f3n de la aplicaci\u00f3n; el gestor se ejecuta autom\u00e1ticamente en el evento no solicitado en el hilo RX del m\u00f3dem.\n\nEl impacto es la divulgaci\u00f3n de pila fuera de l\u00edmites (en registros y an\u00e1lisis) y la corrupci\u00f3n de pila que puede bloquear el hilo RX del m\u00f3dem (denegaci\u00f3n de servicio). El desplazamiento de escritura solo est\u00e1 d\u00e9bilmente controlado, por lo que la ejecuci\u00f3n de c\u00f3digo segura para la memoria no se demuestra. La soluci\u00f3n limita ambos bucles de escaneo por out_len, manteniendo todos los accesos dentro del b\u00fafer linealizado."}], "lastModified": "2026-10-23T16:10:00.313", "sourceIdentifier": "vulnerabilities@zephyrproject.org"}