An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command… (CVE-2026-6232)

CVE-2026-6232 describes an out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware. The flaw occurs when a specially crafted SPI host command contains an oversized length field, causing the firmware to write up to 254 bytes past the boundary of an internal buffer that is non-persistent. Successful exploitation requires physical access to the device and logical access to the SPI bus, limiting the attack surface. No known exploits are reported in the wild. The vulnerability is classified under CWE-787 (Out-of-bounds Write).

The vulnerability allows an attacker with physical and SPI bus access to cause memory corruption by writing beyond the allocated buffer. This could potentially lead to unpredictable device behavior or firmware compromise. However, the requirement for physical and SPI bus access significantly limits the risk of remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Semtech's advisories for updates. Given the requirement for physical and SPI bus access, restricting physical device access and securing the SPI bus interface are recommended interim mitigations.