CVE-2026-7762 (GCVE-0-2026-7762)

Vulnerability from cvelistv5 – Published: 2026-06-05 01:36 – Updated: 2026-06-05 20:19
VLAI
Title
Heap buffer overflow in dot11ah.ko S1G Capabilities IE processing
Summary
A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information Element (IE element ID 0xD9). The function morse_dot11ah_find_s1g_caps_for_bssid() uses the IE length field directly as the size argument to memcpy without validating it against the 15-byte destination buffer. An attacker can supply up to 255 bytes, causing an overflow of up to 240 bytes of attacker-controlled data into adjacent kernel heap memory. The vulnerability is triggerable during normal scanning without authentication, association, or user interaction.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Morse Micro HaLowLink 2 Affected: 0 , < 2.11.13 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-7762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T20:19:09.789917Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T20:19:29.920Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HaLowLink 2",
          "vendor": "Morse Micro",
          "versions": [
            {
              "lessThan": "2.11.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:morsemicro:halow_link_2:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.11.13",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information Element (IE element ID 0xD9). The function morse_dot11ah_find_s1g_caps_for_bssid() uses the IE length field directly as the size argument to memcpy without validating it against the 15-byte destination buffer. An attacker can supply up to 255 bytes, causing an overflow of up to 240 bytes of attacker-controlled data into adjacent kernel heap memory. The vulnerability is triggerable during normal scanning without authentication, association, or user interaction."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T01:36:20.993Z",
        "orgId": "4ac701fe-44e9-4bcd-9585-dd6449257611",
        "shortName": "Bugcrowd"
      },
      "references": [
        {
          "url": "https://www.morsemicro.com/security-advisories/MM-SA-2026-002"
        }
      ],
      "title": "Heap buffer overflow in dot11ah.ko S1G Capabilities IE processing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4ac701fe-44e9-4bcd-9585-dd6449257611",
    "assignerShortName": "Bugcrowd",
    "cveId": "CVE-2026-7762",
    "datePublished": "2026-06-05T01:36:20.993Z",
    "dateReserved": "2026-05-04T05:02:07.918Z",
    "dateUpdated": "2026-06-05T20:19:29.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-7762",
      "date": "2026-07-22",
      "epss": "0.00567",
      "percentile": "0.43533"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-7762\",\"sourceIdentifier\":\"4ac701fe-44e9-4bcd-9585-dd6449257611\",\"published\":\"2026-06-05T02:17:14.510\",\"lastModified\":\"2026-07-23T07:10:00.113\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information Element (IE element ID 0xD9). The function morse_dot11ah_find_s1g_caps_for_bssid() uses the IE length field directly as the size argument to memcpy without validating it against the 15-byte destination buffer. An attacker can supply up to 255 bytes, causing an overflow of up to 240 bytes of attacker-controlled data into adjacent kernel heap memory. The vulnerability is triggerable during normal scanning without authentication, association, or user interaction.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo en el controlador de kernel Wi-Fi HaLow dot11ah.ko en las versiones de software Morse Micro HaLowLink 2 anteriores a la 2.11.13 permite a un atacante no autenticado dentro del alcance de radio causar una denegaci\u00f3n de servicio (p\u00e1nico del kernel) o potencialmente lograr ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de una trama de baliza o de respuesta de sondeo 802.11ah manipulada que contiene un Elemento de Informaci\u00f3n de Capacidades S1G malformado (ID de elemento IE 0xD9). La funci\u00f3n morse_dot11ah_find_s1g_caps_for_bssid() utiliza el campo de longitud del IE directamente como argumento de tama\u00f1o para memcpy sin validarlo contra el b\u00fafer de destino de 15 bytes. Un atacante puede suministrar hasta 255 bytes, causando un desbordamiento de hasta 240 bytes de datos controlados por el atacante en la memoria adyacente del mont\u00edculo del kernel. La vulnerabilidad es activable durante el escaneo normal sin autenticaci\u00f3n, asociaci\u00f3n o interacci\u00f3n del usuario.\"}],\"affected\":[{\"source\":\"4ac701fe-44e9-4bcd-9585-dd6449257611\",\"affectedData\":[{\"vendor\":\"Morse Micro\",\"product\":\"HaLowLink 2\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"2.11.13\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-05T20:19:09.789917Z\",\"id\":\"CVE-2026-7762\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"references\":[{\"url\":\"https://www.morsemicro.com/security-advisories/MM-SA-2026-002\",\"source\":\"4ac701fe-44e9-4bcd-9585-dd6449257611\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-06T06:43:03+00:00",
      "cve": "CVE-2026-7762",
      "id": "CVE-2026-7762",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Heap buffer overflow in dot11ah.ko S1G Capabilities IE processing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7762.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.