{"id":"CVE-2026-12520","summary":"Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers","details":"The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier) parses AT responses with roughly twenty handlers that call net_buf_linearize(value, sizeof(value), *buf, 0, len) into a 128-byte stack buffer and then write value[out_len] = 0. Because net_buf_linearize() (lib/net_buf/buf.c) can return a count equal to its destination-length argument, a field that exactly fills the buffer makes the terminating NUL land one byte past the end, a single-byte out-of-bounds write into adjacent stack memory.\n\nThe +KCELLMEAS cell-measurement handler on_cmd_atcmdinfo_rssi() is worse: it passed the wire length len as the destination size (net_buf_linearize(value, len, *buf, 0, len)), so a response line longer than 128 bytes overflows the value stack buffer with attacker-influenceable content. The line length comes from net_buf_findcrlf(), which accumulates bytes across the whole net_buf fragment chain and is not bounded to 128, so an over-long line reaches the defect.\n\nThe data originates from the cellular modem over UART, driven by the network: operator-scan results, +CGCONTRDP IP/DNS info, socket indications, and +KCELLMEAS neighbour-cell reports. An attacker able to shape what the modem emits — a rogue base station, a compromised modem baseband, or a remote peer feeding oversized response framing — can drive a line past 128 bytes. The handlers run in the driver's RX thread in kernel context, so the corruption is kernel-side.\n\nThe +KCELLMEAS path is a full stack buffer overflow whose worst case is code execution in kernel context and whose floor is a reliable crash; the remaining sites are single-byte NUL out-of-bounds writes. Exploitation requires the modem to emit an over-long AT response line, giving high attack complexity over an adjacent (cellular radio) vector. The fix passes sizeof(dst) - 1 (and correct explicit bounds for the IMSI and +KCELLMEAS sites) so the terminator always stays in bounds.","aliases":["GHSA-9xc4-j5x8-v6jx"],"modified":"2026-08-28T14:32:54.407737Z","published":"2026-08-18T19:41:07.446Z","database_specific":{"cna_assigner":"zephyr","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12520.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12520.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9xc4-j5x8-v6jx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12520"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"7a3b253ced7333f5c0269387a7f3ed1dee69739d"},{"fixed":"ea91f9375677aa4268e4044e096902dbe789f101"}],"database_specific":{"extracted_events":[{"introduced":"2.4.0"},{"fixed":"4.4.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","zephyr-v3.1.0","v3.1.0","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","zephyr-v3.0.0","v3.0.0","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v2.7.99","v2.7.0-rc3","v2.7.0-rc2","v2.7.0-rc1","zephyr-v2.6.0","v2.6.0","v2.6.0-rc3","v2.6.0-rc2","v2.6.0-rc1","zephyr-v2.5.0","v2.5.0","v2.5.0-rc4","v2.5.0-rc3","v2.5.0-rc2","v2.5.0-rc1","zephyr-v2.4.0","v2.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12520.json","vanir_signatures_modified":"2026-08-28T14:32:54Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"39495196660756612223189967223668392266","length":1294},"id":"CVE-2026-12520-0b4b8a9b","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_sock_notif"}},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_atcmdinfo_imsi"},"deprecated":false,"digest":{"function_hash":"31036629938726824870016728003669089419","length":794},"id":"CVE-2026-12520-14f6204d","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"219171408768910000965448416805227788139","length":479},"id":"CVE-2026-12520-199751c1","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_radio_active_bands"},"deprecated":false},{"id":"CVE-2026-12520-19ea2d92","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_atcmdinfo_serial_number"},"deprecated":false,"digest":{"function_hash":"90769587436433012355135725042266895992","length":951}},{"target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_atcmdinfo_operator_status"},"deprecated":false,"digest":{"function_hash":"107300216972505812674067839411222202873","length":791},"id":"CVE-2026-12520-4eb7516e","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101"},{"deprecated":false,"digest":{"function_hash":"338671532272714187295778001554987392289","length":1123},"id":"CVE-2026-12520-60ca8fe4","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"function":"on_cmd_sockcreate","file":"drivers/modem/vendor_standalone/hl7800.c"}},{"deprecated":false,"digest":{"function_hash":"75548776633411915812600476596594339148","length":3626},"id":"CVE-2026-12520-6e216373","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_atcmdinfo_ipaddr"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_gps_event"},"deprecated":false,"digest":{"function_hash":"105718270640641265200205018792519299249","length":620},"id":"CVE-2026-12520-83a0c921"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c"},"deprecated":false,"digest":{"line_hashes":["151543450651159984264787067754454285622","54823687833881657571996535311526476911","321502360962117608503793172738475504016","121114165133766253541914351022351716007","331941532602407315490983114135618475003","93847067828663465317290807124150831095","111720060465905184892166685800369501500","334308932729962858046541472361718882413","121802052238449967471472668053157478092","221771107935920953457082772621818032830","103517184750427747772203568959994529735","319635770790455200409751824565257974405","233221749523994577935407190714236119006","111834046877821709271031041836132689240","149720594518190377521757188821330131490","312515448444255978083110824579834113149","10804589017434753554064204820160648255","265065532984105107574954337197276180489","163442391699865410498963949119697274652","314904390651043548484266050784628712091","284940553330446021705783853116403864653","146731860507465781952952777976734945860","229861373169505367023189855875923619149","201818540281184881979643332113267750689","185972860570576876250137698268430603928","140923363294134292223847351580130437140","295520213495266416846282880810310576455","278184704028346145816862946433741470616","284940553330446021705783853116403864653","146731860507465781952952777976734945860","223809516286645749275558340415315396322","146502730393276126726350685878298357831","3964956411439040254953585291113770188","92961998017459390751926218570223370821","229955057283829953464453612102903517182","319518442216538297746449822897898869768","239241536610536975447017120034285862437","247273758919885046359580428520577259293","312638385726565885993576990489480264264","306493289709858673670897035630436520708","152858993799037737625823365683016925712","149993971018334239343926131070280184224","196393238343534765947643545920428664128","30630640845231880295089136909286094376","246896317844929509917222962371102916392","313523307504494622664463227219335798908","58037084857729916505146833282888551557","335042506645517212770578159400793059417","199578564425843064476303283694987275408","186234599137591096899976609315883497710","164659297168789252063013044547306157188","60822907357362164620175345740314474695","126929607575235184177361368418601081987","123468101482899850544061537266544434428","194602087863317218945724091662250186052","32373313645414773068458196561589496635","184609222768446534626199209749328829376","256607455783095382997382437155325735805","141639358343056725217125842718145406739","60822907357362164620175345740314474695","243543399184658516320109535556967332895","195180448985450696169648549889788087964","203599158698415756381692865302338616696","131646849608282539203601028443103703885","112347524932958663311659652405940320077","52969108824173646026509595266671983300","282283058286308240860352025348265675079","217627173855965708838671449029076692102","210238864160846748829994295072341574106","93652239459875059728750162360603352102","232264734635715730993736326858791322060","224625494870023933862700560525216858939"],"threshold":0.9},"id":"CVE-2026-12520-92b68b32"},{"target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_atcmdinfo_rssi"},"deprecated":false,"digest":{"function_hash":"286229120923240777634973684748131366259","length":943},"id":"CVE-2026-12520-9317a619","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_atcmdinfo_iccid"},"deprecated":false,"digest":{"function_hash":"118831146415356291697881307395513569481","length":805},"id":"CVE-2026-12520-a49b851d"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_radio_band_configuration"},"deprecated":false,"digest":{"function_hash":"28849637961666905848171391932050129675","length":1278},"id":"CVE-2026-12520-a644d0b8"},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_device_service_ind"},"deprecated":false,"digest":{"function_hash":"159050140446941238311290632183098491730","length":548},"id":"CVE-2026-12520-a79ef3c9","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"328069663448973151534995633926429481706","length":901},"id":"CVE-2026-12520-d796401a","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_startup_report"}},{"id":"CVE-2026-12520-db9c25dd","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_radio_tech_status"},"deprecated":false,"digest":{"function_hash":"109336195555073583423438995053585086959","length":360}},{"deprecated":false,"digest":{"function_hash":"215284691819845066296225305663914411617","length":5497},"id":"CVE-2026-12520-e367420d","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"hl7800_rx"}},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_network_report_query"},"deprecated":false,"digest":{"function_hash":"146759485029950728457068486147276687505","length":496},"id":"CVE-2026-12520-f6770faf","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/ea91f9375677aa4268e4044e096902dbe789f101","target":{"file":"drivers/modem/vendor_standalone/hl7800.c","function":"on_cmd_sock_error_code"},"deprecated":false,"digest":{"function_hash":"146459977180678110320114080495843607327","length":493},"id":"CVE-2026-12520-ff8554cc","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"}]}