Is CVE-2026-12519 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12519 being exploited in the wild.

How severe is CVE-2026-12519?

Medium severity, with a CVSS score of 5, published 17 August 2026.

Which products and versions are affected?

WNC-M14A2A LTE-M modem driver unspecified.

Is there a fix for CVE-2026-12519?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12519 attacked?

It is attacked over the network or from the adjacent network.

Am I affected by CVE-2026-12519?

Check whether you run WNC-M14A2A LTE-M modem driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12519: WNC WNC-M14A2A LTE-M modem driver buffer over-read in event handler

CVE-2026-12519 · Severity: medium · CVSS 5 · Published 2026-08-17

The WNC-M14A2A LTE-M modem driver used in cellular IoT devices contains a flaw in how it processes network-derived cellular base station notifications. An attacker controlling a rogue cellular base station, or manipulating radio signals, can trigger out-of-bounds memory reads and writes on the modem by sending specially crafted notifications, leading to information disclosure and potential denial of service affecting modem connectivity.

Vendors: WNC.

Quick answers

Is CVE-2026-12519 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12519 being exploited in the wild.
How severe is CVE-2026-12519?: Medium severity, with a CVSS score of 5, published 17 August 2026.
Which products and versions are affected?: WNC-M14A2A LTE-M modem driver unspecified.
Is there a fix for CVE-2026-12519?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12519 attacked?: It is attacked over the network or from the adjacent network.
Am I affected by CVE-2026-12519?: Check whether you run WNC-M14A2A LTE-M modem driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a classic buffer over-read and out-of-bounds write in the on_cmd_socknotifyev() handler within the modem driver. The %NOTIFYEV: event payload is linearized into a fixed 40-byte stack buffer, capping the copy to 39 bytes; however, two quote-delimiter scanning loops incorrectly use the full CR/LF-delimited frame length instead of the actual linearized length, causing out-of-bounds stack reads when the frame exceeds 39 bytes and lacks quotes in the linearized region. If a quote byte is found in adjacent stack memory, a subsequent null-termination write occurs at an attacker-influenced offset, causing stack corruption. The payload carries network-derived content (LTIME, SIB1, CSPS/RRCSTATE) from the cellular base station, so exploitation requires no user interaction and triggers automatically in the modem RX thread. The impact includes out-of-bounds disclosure and denial of service; code execution is not demonstrated due to weak offset control. The fix bounds both scanning loops by the actual linearized length (out_len).

Affected products

WNC WNC-M14A2A LTE-M modem driver unspecified

Timeline

2026-08-17: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.