CVE-2026-12519

Name of the Vulnerable Software and Affected Versions WNC-M14A2A LTE-M modem driver (affected versions not specified)

Description The driver mishandles unsolicited %NOTIFYEV: events within the on cmd socknotifyev() function located in drivers/modem/vendor standalone/wncm14a2a.c. The issue occurs when a response line is linearized into a fixed 40-byte stack buffer using net buf linearize(). While the copy is capped at 39 bytes, the quote-delimiter scanning loops are bounded by the full frame length returned by net buf findcrlf() instead of the actual linearized length out len.

If a %NOTIFYEV: line exceeds 39 bytes and contains no quotes within the linearized region, the loop indices read adjacent stack memory. This leads to out-of-bounds stack disclosure when the over-read string is passed to strncmp(), atoi(), or LOG *. Additionally, if a quote byte is found outside the buffer bounds, a single-NUL out-of-bounds stack write occurs at an attacker-influenced offset. This flaw can be triggered by a rogue cellular base station, a compromised modem module, or RF manipulation, as the handler runs automatically in the modem RX thread. The impact includes stack disclosure and stack corruption, which can result in a denial of service by crashing the modem RX thread.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.