CVE-2026-12519 zephyrproject CVE debrief

Who should care

Organizations using the WNC-M14A2A LTE-M modem driver should review and apply patches to prevent potential denial of service and out-of-bounds stack disclosure. Affected operators, platforms, and security teams should assess their exposure and implement compensating controls if necessary. Vulnerability management and security teams should prioritize patching and monitoring of affected systems.

Technical summary

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev(). The response line is linearized into a fixed 40-byte stack buffer, but scanning loops are bounded by the full CR/LF-delimited frame length, leading to out-of-bounds stack disclosure and potential denial of service. The impact is out-of-bounds stack disclosure into logs and parsing, and stack corruption that can crash the modem RX thread, resulting in denial of service. The write offset is only weakly controlled, so memory-safe code execution is not demonstrated. A rogue cellular base station, a malicious or compromised modem module, or RF manipulation that induces an over-long notify line can reach the defect without any application interaction; the handler runs automatically on the unsolicited event in the modem RX thread.

Defensive priority

Medium priority due to potential for denial of service and limited control over write offset.

Recommended defensive actions

• Review and apply patches from the vendor
• Monitor modem RX thread for unusual activity
• Implement compensating controls to detect and prevent exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page supports the existence of the vulnerability. However, details on affected products and versions are limited. Affected product deployments should be reviewed for exposure, and defenders should verify system configurations and patch status. Additional information from vendor advisories or source references may be necessary for comprehensive risk assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.