CVE-2026-42799 is a high-severity out-of-bounds read vulnerability (CWE-125) in ASR Kestrel's nr_fw modules, specifically in the NrPwrCtrl.C source file. This vulnerability allows an attacker with low privileges to remotely trigger a condition where the program reads memory outside the intended buffer boundaries, potentially causing buffer overflow effects. The vulnerability affects Kestrel versions prior to 2026/02/10. The CVSS 3.1 vector indicates network attack vector, low complexity, no user interaction, and scope change, with partial impacts on confidentiality, integrity, and availability. No patch or official remediation level is currently documented, and no exploits are known in the wild.

The vulnerability can lead to partial loss of confidentiality, integrity, and availability due to out-of-bounds memory reads and buffer overflow conditions. This may allow attackers to access sensitive information, corrupt data, or cause denial of service. The attack requires network access and low privileges but no user interaction. The scope of impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor ASR's advisories for updates and apply patches once available.