Semtech LR11xx CVE-2026-6232

Exploitation requires (1) physical access to the device and (2) logical access to the SPI bus connecting the host to the LR11xx transceiver, after which the attacker sends a crafted SPI host command whose length field is oversized, triggering a write of up to 254 bytes past an internal non-persistent memory buffer. Limiting factors that sharply reduce real-world risk: there is no network or remote vector (AV:P), no user interaction is needed but hands-on hardware/bus access is mandatory, the corrupted buffer is non-persistent so effects may be cleared by reset, and impact is limited to integrity/availability of the transceiver (no confidentiality exposure). Devices whose SPI bus is physically inaccessible or sealed are effectively not exploitable.

This is a genuinely low-to-moderate real-world risk despite being a memory-corruption (out-of-bounds write, CWE-787) issue. The vendor-supplied CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) scores 5.2 (Medium), and the single most important signal is AV:P - physical access plus logical access to the SPI bus is required, which collapses the practical attack surface to someone who already has hands-on the device or its circuit board. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Impact is integrity/availability only (VI:H/VA:H) with no confidentiality impact (VC:N) and no scope/subsequent-system change (SC:N/SI:N/SA:N), consistent with corrupting a non-persistent internal buffer to crash or alter transceiver behavior rather than exfiltrate data. The R:U (recovery: unrecoverable) and RE:M (remediation effort) modifiers suggest a device may need manual reset or reflash after a successful write. Signals are internally consistent - there is no conflict between the vector and the description, both point to a local/physical, non-networked flaw. Bottom line: not a patch-tonight priority for most fleets; it matters mainly where an attacker can plausibly obtain physical/bus access (lost, stolen, shared, or field-deployed unattended IoT hardware).

An attacker with physical possession of a LoRa/IoT device built on a Semtech LR11xx part connects to the exposed SPI bus (e.g., via test points or an unprotected header) and issues a malformed SPI host command containing an oversized length field. The firmware then writes up to 254 attacker-controlled bytes past the end of an internal RAM buffer, corrupting adjacent memory to crash, hang, or alter the transceiver's behavior. No public POC is available at time of analysis, and the attack cannot be performed remotely.