CVE-2026-12520

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-12520

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12520.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-12520

Aliases

GHSA-9xc4-j5x8-v6jx

Published

2026-08-18T19:41:07Z

Modified

2026-08-28T14:32:54Z

Severity

6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H CVSS Calculator

Summary

Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers

Details

The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier) parses AT responses with roughly twenty handlers that call net_buf_linearize(value, sizeof(value), *buf, 0, len) into a 128-byte stack buffer and then write value[out_len] = 0. Because net_buf_linearize() (lib/net_buf/buf.c) can return a count equal to its destination-length argument, a field that exactly fills the buffer makes the terminating NUL land one byte past the end, a single-byte out-of-bounds write into adjacent stack memory.

The +KCELLMEAS cell-measurement handler on_cmd_atcmdinfo_rssi() is worse: it passed the wire length len as the destination size (net_buf_linearize(value, len, *buf, 0, len)), so a response line longer than 128 bytes overflows the value stack buffer with attacker-influenceable content. The line length comes from net_buf_findcrlf(), which accumulates bytes across the whole net_buf fragment chain and is not bounded to 128, so an over-long line reaches the defect.

The data originates from the cellular modem over UART, driven by the network: operator-scan results, +CGCONTRDP IP/DNS info, socket indications, and +KCELLMEAS neighbour-cell reports. An attacker able to shape what the modem emits — a rogue base station, a compromised modem baseband, or a remote peer feeding oversized response framing — can drive a line past 128 bytes. The handlers run in the driver's RX thread in kernel context, so the corruption is kernel-side.

The +KCELLMEAS path is a full stack buffer overflow whose worst case is code execution in kernel context and whose floor is a reliable crash; the remaining sites are single-byte NUL out-of-bounds writes. Exploitation requires the modem to emit an over-long AT response line, giving high attack complexity over an adjacent (cellular radio) vector. The fix passes sizeof(dst) - 1 (and correct explicit bounds for the IMSI and +KCELLMEAS sites) so the terminator always stays in bounds.

Database specific

{
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12520.json"
}

References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type

GIT

Repo

https://github.com/zephyrproject-rtos/zephyr

Events

Introduced

7a3b253ced7333f5c0269387a7f3ed1dee69739d

Fixed

ea91f9375677aa4268e4044e096902dbe789f101

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "2.4.0"
        },
        {
            "fixed": "4.4.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v2.*

v2.4.0

v2.5.0

v2.5.0-rc1

v2.5.0-rc2

v2.5.0-rc3

v2.5.0-rc4

v2.6.0

v2.6.0-rc1

v2.6.0-rc2

v2.6.0-rc3

v2.7.0-rc1

v2.7.0-rc2

v2.7.0-rc3

v2.7.99

v3.*

v3.0.0

v3.0.0-rc1

v3.0.0-rc2

v3.0.0-rc3

v3.1.0

v3.1.0-rc1

v3.1.0-rc2

v3.1.0-rc3

v3.2.0

v3.2.0-rc1

v3.2.0-rc2

v3.2.0-rc3

v3.3.0

v3.3.0-rc1

v3.3.0-rc2

v3.3.0-rc3

v3.4.0

v3.4.0-rc1

v3.4.0-rc2

v3.4.0-rc3

v3.5.0

v3.5.0-rc1

v3.5.0-rc2

v3.5.0-rc3

v3.6.0

v3.6.0-rc1

v3.6.0-rc2

v3.6.0-rc3

v3.7.0

v3.7.0-rc1

v3.7.0-rc2

v3.7.0-rc3

v4.*

v4.0.0

v4.0.0-rc1

v4.0.0-rc2

v4.0.0-rc3

v4.1.0

v4.1.0-rc1

v4.1.0-rc2

v4.1.0-rc3

v4.2.0

v4.2.0-rc1

v4.2.0-rc2

v4.2.0-rc3

v4.3.0

v4.3.0-rc1

v4.3.0-rc2

v4.3.0-rc3

v4.4.0

v4.4.0-rc1

v4.4.0-rc2

v4.4.0-rc3

zephyr-v2.*

zephyr-v2.4.0

zephyr-v2.5.0

zephyr-v2.6.0

zephyr-v3.*

zephyr-v3.0.0

zephyr-v3.1.0

zephyr-v3.2.0

zephyr-v3.3.0

zephyr-v3.4.0

zephyr-v3.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12520.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "39495196660756612223189967223668392266",
            "length": 1294
        },
        "id": "CVE-2026-12520-0b4b8a9b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_sock_notif"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "31036629938726824870016728003669089419",
            "length": 794
        },
        "id": "CVE-2026-12520-14f6204d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_atcmdinfo_imsi"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "219171408768910000965448416805227788139",
            "length": 479
        },
        "id": "CVE-2026-12520-199751c1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_radio_active_bands"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "90769587436433012355135725042266895992",
            "length": 951
        },
        "id": "CVE-2026-12520-19ea2d92",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_atcmdinfo_serial_number"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "107300216972505812674067839411222202873",
            "length": 791
        },
        "id": "CVE-2026-12520-4eb7516e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_atcmdinfo_operator_status"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "338671532272714187295778001554987392289",
            "length": 1123
        },
        "id": "CVE-2026-12520-60ca8fe4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_sockcreate"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "75548776633411915812600476596594339148",
            "length": 3626
        },
        "id": "CVE-2026-12520-6e216373",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_atcmdinfo_ipaddr"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "105718270640641265200205018792519299249",
            "length": 620
        },
        "id": "CVE-2026-12520-83a0c921",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_gps_event"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "151543450651159984264787067754454285622",
                "54823687833881657571996535311526476911",
                "321502360962117608503793172738475504016",
                "121114165133766253541914351022351716007",
                "331941532602407315490983114135618475003",
                "93847067828663465317290807124150831095",
                "111720060465905184892166685800369501500",
                "334308932729962858046541472361718882413",
                "121802052238449967471472668053157478092",
                "221771107935920953457082772621818032830",
                "103517184750427747772203568959994529735",
                "319635770790455200409751824565257974405",
                "233221749523994577935407190714236119006",
                "111834046877821709271031041836132689240",
                "149720594518190377521757188821330131490",
                "312515448444255978083110824579834113149",
                "10804589017434753554064204820160648255",
                "265065532984105107574954337197276180489",
                "163442391699865410498963949119697274652",
                "314904390651043548484266050784628712091",
                "284940553330446021705783853116403864653",
                "146731860507465781952952777976734945860",
                "229861373169505367023189855875923619149",
                "201818540281184881979643332113267750689",
                "185972860570576876250137698268430603928",
                "140923363294134292223847351580130437140",
                "295520213495266416846282880810310576455",
                "278184704028346145816862946433741470616",
                "284940553330446021705783853116403864653",
                "146731860507465781952952777976734945860",
                "223809516286645749275558340415315396322",
                "146502730393276126726350685878298357831",
                "3964956411439040254953585291113770188",
                "92961998017459390751926218570223370821",
                "229955057283829953464453612102903517182",
                "319518442216538297746449822897898869768",
                "239241536610536975447017120034285862437",
                "247273758919885046359580428520577259293",
                "312638385726565885993576990489480264264",
                "306493289709858673670897035630436520708",
                "152858993799037737625823365683016925712",
                "149993971018334239343926131070280184224",
                "196393238343534765947643545920428664128",
                "30630640845231880295089136909286094376",
                "246896317844929509917222962371102916392",
                "313523307504494622664463227219335798908",
                "58037084857729916505146833282888551557",
                "335042506645517212770578159400793059417",
                "199578564425843064476303283694987275408",
                "186234599137591096899976609315883497710",
                "164659297168789252063013044547306157188",
                "60822907357362164620175345740314474695",
                "126929607575235184177361368418601081987",
                "123468101482899850544061537266544434428",
                "194602087863317218945724091662250186052",
                "32373313645414773068458196561589496635",
                "184609222768446534626199209749328829376",
                "256607455783095382997382437155325735805",
                "141639358343056725217125842718145406739",
                "60822907357362164620175345740314474695",
                "243543399184658516320109535556967332895",
                "195180448985450696169648549889788087964",
                "203599158698415756381692865302338616696",
                "131646849608282539203601028443103703885",
                "112347524932958663311659652405940320077",
                "52969108824173646026509595266671983300",
                "282283058286308240860352025348265675079",
                "217627173855965708838671449029076692102",
                "210238864160846748829994295072341574106",
                "93652239459875059728750162360603352102",
                "232264734635715730993736326858791322060",
                "224625494870023933862700560525216858939"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-12520-92b68b32",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "286229120923240777634973684748131366259",
            "length": 943
        },
        "id": "CVE-2026-12520-9317a619",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_atcmdinfo_rssi"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "118831146415356291697881307395513569481",
            "length": 805
        },
        "id": "CVE-2026-12520-a49b851d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_atcmdinfo_iccid"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "28849637961666905848171391932050129675",
            "length": 1278
        },
        "id": "CVE-2026-12520-a644d0b8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_radio_band_configuration"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "159050140446941238311290632183098491730",
            "length": 548
        },
        "id": "CVE-2026-12520-a79ef3c9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_device_service_ind"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "328069663448973151534995633926429481706",
            "length": 901
        },
        "id": "CVE-2026-12520-d796401a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_startup_report"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "109336195555073583423438995053585086959",
            "length": 360
        },
        "id": "CVE-2026-12520-db9c25dd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_radio_tech_status"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "215284691819845066296225305663914411617",
            "length": 5497
        },
        "id": "CVE-2026-12520-e367420d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "hl7800_rx"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "146759485029950728457068486147276687505",
            "length": 496
        },
        "id": "CVE-2026-12520-f6770faf",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_network_report_query"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "146459977180678110320114080495843607327",
            "length": 493
        },
        "id": "CVE-2026-12520-ff8554cc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101",
        "target": {
            "file": "drivers/modem/vendor_standalone/hl7800.c",
            "function": "on_cmd_sock_error_code"
        }
    }
]

vanir_signatures_modified

"2026-08-28T14:32:54Z"