CVE-2026-12519

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a2a.c). The response line is linearized into a fixed 40-byte stack buffer via net_buf_linearize(), which caps the copy at 39 bytes and returns out_len <= 39. The two quote-delimiter scanning loops, however, were bounded by len — the full CR/LF-delimited frame length returned by net_buf_findcrlf() — rather than by out_len. When a %NOTIFYEV: line longer than 39 bytes contains no " within the linearized region, the loop indices p1/p2 walk past value[39] and read adjacent stack memory until a stray quote byte is found or the index reaches len. The over-read string is then passed to strncmp()/atoi()/LOG_*, and if a quote byte is found out of bounds the subsequent value[p2] = '\0' performs a single-NUL out-of-bounds stack write at an attacker-influenced offset. The %NOTIFYEV: payload carries network-derived content (LTIME network time, SIB1 base-station system information, CSPS/RRCSTATE), so a rogue cellular base station, a malicious or compromised modem module, or RF manipulation that induces an over-long notify line reaches the defect without any application interaction; the handler runs automatically on the unsolicited event in the modem RX thread. The impact is out-of-bounds stack disclosure (into logs and parsing) and stack corruption that can crash the modem RX thread (denial of service). The write offset is only weakly controlled, so memory-safe code execution is not demonstrated. The fix bounds both scanning loops by out_len, keeping all accesses within the linearized buffer.

• CWE-787

• https://github.com/zephyrproject-rtos/zephyr/commit/c516cb7c14f8b0537811764daa94bedc50c230f3
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8hrc-q8cp-6xhf

Published

Aug 17, 2026

Last Modified

Nov 4, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125184FFmpeg 6.1 through 9.0.2 contains an information disclosure …3.3
• CVE-2026-125185FFmpeg through 9.0.2 contains a division by zero vulnerabili…5.5
• CVE-2026-125186FFmpeg through 9.0.2 contains an uncontrolled resource consu…4.7
• CVE-2026-125187FFmpeg through 9.0.2 contains a reachable assertion vulnerab…5.5
• CVE-2026-125188FFmpeg through 9.0.2 contains a heap out-of-bounds read vuln…2.5
• CVE-2026-125189FFmpeg 8.1 through 9.0.2 contains a denial of service vulner…4.7
• CVE-2026-125190FFmpeg through 9.0.2 contains an information disclosure vuln…3.3
• CVE-2026-125191FFmpeg through 9.0.2 contains a reference count leak in liba…4.7
• CVE-2026-125192FFmpeg through 9.0.2 contains an uninitialized memory vulner…3.3
• CVE-2026-125193FFmpeg through 9.0.2 contains an out-of-bounds read vulnerab…6.1
• CVE-2026-125194FFmpeg through 9.0.2 contains an out-of-bounds read vulnerab…5.5
• CVE-2026-125195FFmpeg through 9.0.2 contains an uninitialized memory disclo…2.5