CVE-2026-75085

Name of the Vulnerable Software and Affected Versions STM32WBA IEEE 802.15.4 driver (affected versions not specified)

Description An out-of-bounds read exists in the IEEE 802.15.4 driver for STM32WBA within the drivers/ieee802154/ieee802154 stm32wba.c file. The issue occurs because the driver calculates the packet length of a received frame by subtracting the Frame Check Sequence (FCS) length from the radio-reported length without verifying if the reported length is sufficient to contain an FCS. Since the resulting pkt len variable is a uint8 t, a reported length of 0 or 1 causes an integer underflow, wrapping the value to 254 or 255.

An attacker within radio range can influence this length via the PHY header of a received frame. When the underflow occurs, the stm32wba 802154 rx thread() function calls net pkt write() with an oversized length, causing the system to read approximately 128 bytes beyond the end of the radio receive buffer. This can lead to the disclosure of adjacent RAM contents and unnecessary oversized packet allocation in the RX thread.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.