{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-12519 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-12519 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-12519 is a medium-severity memory corruption vulnerability in zephyrproject zephyr, published on 17 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-12519 and fix it if it is affected.\n\nWhat it is: CVE-2026-12519 is a medium-severity memory corruption vulnerability in zephyrproject zephyr, published on 17 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-12519 in the wild and no public exploit code.\n\nAffected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-12519/ (Markdown: https://insights.sbomify.com/CVE-2026-12519/index.md)","id":"CVE-2026-12519","markdown":"https://insights.sbomify.com/CVE-2026-12519/index.md","name":"CVE-2026-12519","record":{"aliases":["GHSA-8hrc-q8cp-6xhf"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service","data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Zephyr RTOS","requires_auth":"none","summary":"A remote attacker can cause denial of service and information disclosure in Zephyr RTOS via a malicious cellular base station triggering a stack buffer overflow in the WNC-M14A2A modem driver.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[],"cvss":{"score":5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"description":"The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a2a.c). The response line is linearized into a fixed 40-byte stack buffer via net_buf_linearize(), which caps the copy at 39 bytes and returns out_len \u003c= 39. The two quote-delimiter scanning loops, however, were bounded by len — the full CR/LF-delimited frame length returned by net_buf_findcrlf() — rather than by out_len.\n\nWhen a %NOTIFYEV: line longer than 39 bytes contains no \" within the linearized region, the loop indices p1/p2 walk past value[39] and read adjacent stack memory until a stray quote byte is found or the index reaches len. The over-read string is then passed to strncmp()/atoi()/LOG_*, and if a quote byte is found out of bounds the subsequent value[p2] = '\\0' performs a single-NUL out-of-bounds stack write at an attacker-influenced offset.\n\nThe %NOTIFYEV: payload carries network-derived content (LTIME network time, SIB1 base-station system information, CSPS/RRCSTATE), so a rogue cellular base station, a malicious or compromised modem module, or RF manipulation that induces an over-long notify line reaches the defect without any application interaction; the handler runs automatically on the unsolicited event in the modem RX thread.\n\nThe impact is out-of-bounds stack disclosure (into logs and parsing) and stack corruption that can crash the modem RX thread (denial of service). The write offset is only weakly controlled, so memory-safe code execution is not demonstrated. The fix bounds both scanning loops by out_len, keeping all accesses within the linearized buffer.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing","id":"CVE-2026-12519","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers","id":"CVE-2026-12520"},"packages":[],"prev":{"headline":"Local privilege escalation in the Logi Options+ updater service on Windows","id":"CVE-2026-12518"},"products":["zephyr"],"published":"2026-08-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-17","vendors":["zephyrproject"]},"summary":"A remote attacker can cause denial of service and information disclosure in Zephyr RTOS via a malicious cellular base station triggering a stack buffer overflow in the WNC-M14A2A modem driver.","url":"https://insights.sbomify.com/CVE-2026-12519/"}