The WNC-M14A2A LTE-M modem driver in Zephyr improperly handles unsolicited %NOTIFYEV: events in the on_cmd_socknotifyev() function. The response line is copied into a fixed 40-byte stack buffer with a maximum of 39 bytes, but two quote-delimiter scanning loops use the full frame length rather than the capped length, allowing them to read past the buffer boundary. If the %NOTIFYEV: line is longer than 39 bytes and contains no quotes within the linearized region, the loops read adjacent stack memory until a quote is found or the end is reached. This leads to an out-of-bounds single-byte stack write at an attacker-influenced offset. The payload includes network-derived data such as network time and base-station information, so an attacker controlling the cellular environment can trigger this without application interaction. The impact includes stack memory disclosure and potential denial of service via modem RX thread crash. The vulnerability does not demonstrate memory-safe code execution. The fix bounds the scanning loops by the capped buffer length to prevent out-of-bounds access.

The vulnerability allows out-of-bounds stack memory disclosure and a single-byte out-of-bounds stack write, which can corrupt the stack and crash the modem RX thread, causing denial of service. The write offset is weakly controlled, so arbitrary code execution is not demonstrated. The vulnerability can be triggered remotely by a rogue cellular base station or compromised modem module without user or application interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves bounding the scanning loops by the capped buffer length to prevent out-of-bounds access. Until an official fix is available, monitor vendor communications for updates. No generic mitigations are specifically recommended by the vendor advisory.