CVE-2026-12519
Full vulnerability record from the local CVENow database.
Description
The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a2a.c). The response line is linearized into a fixed 40-byte stack buffer via net_buf_linearize(), which caps the copy at 39 bytes and returns out_len <= 39. The two quote-delimiter scanning loops, however, were bounded by len — the full CR/LF-delimited frame length returned by net_buf_findcrlf() — rather than by out_len. When a %NOTIFYEV: line longer than 39 bytes contains no " within the linearized region, the loop indices p1/p2 walk past value[39] and read adjacent stack memory until a stray quote byte is found or the index reaches len. The over-read string is then passed to strncmp()/atoi()/LOG_*, and if a quote byte is found out of bounds the subsequent value[p2] = '\0' performs a single-NUL out-of-bounds stack write at an attacker-influenced offset. The %NOTIFYEV: payload carries network-derived content (LTIME network time, SIB1 base-station system information, CSPS/RRCSTATE), so a rogue cellular base station, a malicious or compromised modem module, or RF manipulation that induces an over-long notify line reaches the defect without any application interaction; the handler runs automatically on the unsolicited event in the modem RX thread. The impact is out-of-bounds stack disclosure (into logs and parsing) and stack corruption that can crash the modem RX thread (denial of service). The write offset is only weakly controlled, so memory-safe code execution is not demonstrated. The fix bounds both scanning loops by out_len, keeping all accesses within the linearized buffer.
View original CVE JSON
{
"id": "CVE-2026-12519",
"sourceIdentifier": "[email protected]",
"published": "2026-08-17T17:16:38.867",
"lastModified": "2026-10-23T16:10:00.313",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a2a.c). The response line is linearized into a fixed 40-byte stack buffer via net_buf_linearize(), which caps the copy at 39 bytes and returns out_len <= 39. The two quote-delimiter scanning loops, however, were bounded by len — the full CR/LF-delimited frame length returned by net_buf_findcrlf() — rather than by out_len.\n\nWhen a %NOTIFYEV: line longer than 39 bytes contains no \" within the linearized region, the loop indices p1/p2 walk past value[39] and read adjacent stack memory until a stray quote byte is found or the index reaches len. The over-read string is then passed to strncmp()/atoi()/LOG_*, and if a quote byte is found out of bounds the subsequent value[p2] = '\\0' performs a single-NUL out-of-bounds stack write at an attacker-influenced offset.\n\nThe %NOTIFYEV: payload carries network-derived content (LTIME network time, SIB1 base-station system information, CSPS/RRCSTATE), so a rogue cellular base station, a malicious or compromised modem module, or RF manipulation that induces an over-long notify line reaches the defect without any application interaction; the handler runs automatically on the unsolicited event in the modem RX thread.\n\nThe impact is out-of-bounds stack disclosure (into logs and parsing) and stack corruption that can crash the modem RX thread (denial of service). The write offset is only weakly controlled, so memory-safe code execution is not demonstrated. The fix bounds both scanning loops by out_len, keeping all accesses within the linearized buffer."
},
{
"lang": "es",
"value": "El controlador del módem LTE-M WNC-M14A2A gestiona incorrectamente los eventos %NOTIFYEV: no solicitados en on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a2a.c). La línea de respuesta se linealiza en un búfer de pila fijo de 40 bytes a través de net_buf_linearize(), que limita la copia a 39 bytes y devuelve out_len menor o igual que 39. Los dos bucles de escaneo de delimitadores de comillas, sin embargo, estaban limitados por len - la longitud completa del marco delimitado por CR/LF devuelta por net_buf_findcrlf() - en lugar de por out_len.\n\nCuando una línea %NOTIFYEV: de más de 39 bytes no contiene ’ dentro de la región linealizada, los índices de bucle p1/p2 superan value[39] y leen memoria de pila adyacente hasta que se encuentra un byte de comilla extraviado o el índice alcanza len. La cadena sobreleída se pasa entonces a strncmp()/atoi()/LOG_*, y si se encuentra un byte de comilla fuera de los límites, el subsiguiente value[p2] = ’\\0’ realiza una escritura de pila fuera de límites de un solo NUL en un desplazamiento influenciado por el atacante.\n\nLa carga útil %NOTIFYEV: transporta contenido derivado de la red (hora de red LTIME, información del sistema de estación base SIB1, CSPS/RRCSTATE), por lo que una estación base celular maliciosa, un módulo de módem malicioso o comprometido, o manipulación de RF que induce una línea de notificación excesivamente larga alcanza el defecto sin ninguna interacción de la aplicación; el gestor se ejecuta automáticamente en el evento no solicitado en el hilo RX del módem.\n\nEl impacto es la divulgación de pila fuera de límites (en registros y análisis) y la corrupción de pila que puede bloquear el hilo RX del módem (denegación de servicio). El desplazamiento de escritura solo está débilmente controlado, por lo que la ejecución de código segura para la memoria no se demuestra. La solución limita ambos bucles de escaneo por out_len, manteniendo todos los accesos dentro del búfer linealizado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "zephyrproject",
"product": "zephyr",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
"packageName": "zephyr",
"programFiles": [
"drivers/modem/vendor_standalone/wncm14a2a.c"
],
"versions": [
{
"version": "1.13.0",
"lessThan": "4.4.2",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.6,
"impactScore": 3.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-17T18:21:35.823541Z",
"id": "CVE-2026-12519",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"references": [
{
"url": "https://github.com/zephyrproject-rtos/zephyr/commit/c516cb7c14f8b0537811764daa94bedc50c230f3",
"source": "[email protected]"
},
{
"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8hrc-q8cp-6xhf",
"source": "[email protected]"
}
]
}