CVE-2026-7762

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7762", "assignerOrgId": "4ac701fe-44e9-4bcd-9585-dd6449257611", "state": "PUBLISHED", "assignerShortName": "Bugcrowd", "dateReserved": "2026-05-04T05:02:07.918Z", "datePublished": "2026-06-05T01:36:20.993Z", "dateUpdated": "2026-06-05T20:19:29.920Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4ac701fe-44e9-4bcd-9585-dd6449257611", "shortName": "Bugcrowd", "dateUpdated": "2026-06-05T01:36:20.993Z"}, "title": "Heap buffer overflow in dot11ah.ko S1G Capabilities IE processing", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "affected": [{"vendor": "Morse Micro", "product": "HaLowLink 2", "versions": [{"version": "0", "status": "affected", "lessThan": "2.11.13", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:morsemicro:halow_link_2:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "2.11.13"}]}]}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information Element (IE element ID 0xD9). The function morse_dot11ah_find_s1g_caps_for_bssid() uses the IE length field directly as the size argument to memcpy without validating it against the 15-byte destination buffer. An attacker can supply up to 255 bytes, causing an overflow of up to 240 bytes of attacker-controlled data into adjacent kernel heap memory. The vulnerability is triggerable during normal scanning without authentication, association, or user interaction."}], "references": [{"url": "https://www.morsemicro.com/security-advisories/MM-SA-2026-002"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-06-05T20:19:09.789917Z", "id": "CVE-2026-7762", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-05T20:19:29.920Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-7762", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-05T20:19:09.789917Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-05T20:19:25.727Z"}}], "cna": {"title": "Heap buffer overflow in dot11ah.ko S1G Capabilities IE processing", "affected": [{"vendor": "Morse Micro", "product": "HaLowLink 2", "versions": [{"status": "affected", "version": "0", "lessThan": "2.11.13", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.morsemicro.com/security-advisories/MM-SA-2026-002"}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information Element (IE element ID 0xD9). The function morse_dot11ah_find_s1g_caps_for_bssid() uses the IE length field directly as the size argument to memcpy without validating it against the 15-byte destination buffer. An attacker can supply up to 255 bytes, causing an overflow of up to 240 bytes of attacker-controlled data into adjacent kernel heap memory. The vulnerability is triggerable during normal scanning without authentication, association, or user interaction."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:morsemicro:halow_link_2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.11.13", "versionStartIncluding": "0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "4ac701fe-44e9-4bcd-9585-dd6449257611", "shortName": "Bugcrowd", "dateUpdated": "2026-06-05T01:36:20.993Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7762", "state": "PUBLISHED", "dateUpdated": "2026-06-05T20:19:29.920Z", "dateReserved": "2026-05-04T05:02:07.918Z", "assignerOrgId": "4ac701fe-44e9-4bcd-9585-dd6449257611", "datePublished": "2026-06-05T01:36:20.993Z", "assignerShortName": "Bugcrowd"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HaLowLink 2", "vendor": "Morse Micro", "versions": [{"lessThan": "2.11.13", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "4ac701fe-44e9-4bcd-9585-dd6449257611"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information Element (IE element ID 0xD9). The function morse_dot11ah_find_s1g_caps_for_bssid() uses the IE length field directly as the size argument to memcpy without validating it against the 15-byte destination buffer. An attacker can supply up to 255 bytes, causing an overflow of up to 240 bytes of attacker-controlled data into adjacent kernel heap memory. The vulnerability is triggerable during normal scanning without authentication, association, or user interaction."}, {"lang": "es", "value": "Una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo en el controlador de kernel Wi-Fi HaLow dot11ah.ko en las versiones de software Morse Micro HaLowLink 2 anteriores a la 2.11.13 permite a un atacante no autenticado dentro del alcance de radio causar una denegaci\u00f3n de servicio (p\u00e1nico del kernel) o potencialmente lograr ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de una trama de baliza o de respuesta de sondeo 802.11ah manipulada que contiene un Elemento de Informaci\u00f3n de Capacidades S1G malformado (ID de elemento IE 0xD9). La funci\u00f3n morse_dot11ah_find_s1g_caps_for_bssid() utiliza el campo de longitud del IE directamente como argumento de tama\u00f1o para memcpy sin validarlo contra el b\u00fafer de destino de 15 bytes. Un atacante puede suministrar hasta 255 bytes, causando un desbordamiento de hasta 240 bytes de datos controlados por el atacante en la memoria adyacente del mont\u00edculo del kernel. La vulnerabilidad es activable durante el escaneo normal sin autenticaci\u00f3n, asociaci\u00f3n o interacci\u00f3n del usuario."}], "id": "CVE-2026-7762", "lastModified": "2026-07-23T07:10:00.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7762", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-05T20:19:09.789917Z", "version": "2.0.3"}}]}, "published": "2026-06-05T02:17:14.510", "references": [{"source": "4ac701fe-44e9-4bcd-9585-dd6449257611", "url": "https://www.morsemicro.com/security-advisories/MM-SA-2026-002"}], "sourceIdentifier": "4ac701fe-44e9-4bcd-9585-dd6449257611", "vulnStatus": "Awaiting Analysis"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.13)"}}], "enrichment": {"confidence": 96.0, "confidence_source": "matching", "scores": [{"score": 96.0, "source": "matching"}]}, "original": {"product": "HaLowLink 2", "source": "cna", "vendor": "Morse Micro"}, "product": "halow_link_2", "vendor": "morsemicro"}], "created": "2026-06-05T04:45:32.037676+00:00", "updated": "2026-06-05T22:30:06.171934+00:00", "vendors": ["morsemicro", "morsemicro$PRODUCT$halow_link_2"], "weaknesses": ["CWE-122", "CWE-119"]}