CVE-2026-12522

The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr() in drivers/modem/vendor_standalone/hl7800.c parses the PDP-context dynamic parameters (local address, subnet mask, gateway, and DNS servers) that the cellular network assigns to the device. The response is linearized into a 256-byte stack buffer, after which each address field length is computed from comma/. delimiter positions in the network-supplied data and used directly as the length argument to strncpy() into the fixed 64-byte stack buffer temp_addr_str (and the 16-byte iface_ctx.dns_v4_string). Because the field length is derived from attacker-controlled delimiter positions and was not bounded against the destination buffer, a single field can be far larger than 64 bytes. A malicious or impersonated cellular network (for example a rogue base station) can return a crafted +CGCONTRDP response with an overlong address field, causing strncpy() to write past temp_addr_str on the modem worker thread's stack, plus an out-of-bounds NUL write at temp_addr_str[addr_len]. No device-side privileges or user interaction are required: the device itself issues the AT+CGCONTRDP=1 query during normal network attach and parses whatever the network returns. The overflow corrupts adjacent stack memory in supervisor context, yielding at minimum a remotely triggerable crash and potentially control-flow hijacking on targets without stack protection. The fix bounds every field length against its destination buffer (temp_addr_str and dns_v4_string) before each copy, rejecting overlong fields.

• CWE-787

• https://github.com/zephyrproject-rtos/zephyr/commit/a1cbced64181bc0bdf95e1fd7118f2bb70cf679b
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hchc-6489-w66v

Published

Aug 19, 2026

Last Modified

Nov 4, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125214FFmpeg through 9.0.2 contains a heap buffer overflow vulnera…7
• CVE-2026-125215FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference…4.7
• CVE-2026-125216FFmpeg through 9.0.2 contains a NULL pointer dereference vul…5.5
• CVE-2026-125217FFmpeg through 9.0.2 contains an uninitialized memory use vu…3.3
• CVE-2026-125218FFmpeg through 9.0.2 contains a heap buffer overflow vulnera…7
• CVE-2026-125219FFmpeg through 9.0.2 contains a heap buffer overflow vulnera…7
• CVE-2026-125220FFmpeg through 9.0.2 contains a deadlock vulnerability in mi…5.5
• CVE-2026-125221FFmpeg through 9.0.2 contains an uncontrolled recursion vuln…5.5
• CVE-2026-125222FFmpeg through 9.0.2 contains an integer overflow vulnerabil…7
• CVE-2026-125223FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerabilit…4.7
• CVE-2026-125224FFmpeg through 9.0.2 contains a denial of service vulnerabil…5.5
• CVE-2026-125225FFmpeg through 9.0.2 contains a NULL pointer dereference vul…5.5