# CVE-2026-12519: WNC WNC-M14A2A LTE-M modem driver buffer over-read in event handler

Source: https://junglewise.ai/threats/cve-2026-12519-wnc-wnc-m14a2a-lte-m-modem-driver-buffer-over-read-in-event  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-12519 · Severity: medium · CVSS 5 · Published 2026-08-17

The WNC-M14A2A LTE-M modem driver used in cellular IoT devices contains a flaw in how it processes network-derived cellular base station notifications. An attacker controlling a rogue cellular base station, or manipulating radio signals, can trigger out-of-bounds memory reads and writes on the modem by sending specially crafted notifications, leading to information disclosure and potential denial of service affecting modem connectivity.

Vendors: [WNC](https://junglewise.ai/threats/vendors/wnc).

## Quick answers

**Is CVE-2026-12519 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12519 being exploited in the wild.

**How severe is CVE-2026-12519?** Medium severity, with a CVSS score of 5, published 17 August 2026.

**Which products and versions are affected?** WNC-M14A2A LTE-M modem driver unspecified.

**Is there a fix for CVE-2026-12519?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12519 attacked?** It is attacked over the network or from the adjacent network.

**Am I affected by CVE-2026-12519?** Check whether you run WNC-M14A2A LTE-M modem driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a classic buffer over-read and out-of-bounds write in the on_cmd_socknotifyev() handler within the modem driver. The %NOTIFYEV: event payload is linearized into a fixed 40-byte stack buffer, capping the copy to 39 bytes; however, two quote-delimiter scanning loops incorrectly use the full CR/LF-delimited frame length instead of the actual linearized length, causing out-of-bounds stack reads when the frame exceeds 39 bytes and lacks quotes in the linearized region. If a quote byte is found in adjacent stack memory, a subsequent null-termination write occurs at an attacker-influenced offset, causing stack corruption. The payload carries network-derived content (LTIME, SIB1, CSPS/RRCSTATE) from the cellular base station, so exploitation requires no user interaction and triggers automatically in the modem RX thread. The impact includes out-of-bounds disclosure and denial of service; code execution is not demonstrated due to weak offset control. The fix bounds both scanning loops by the actual linearized length (out_len).

## Affected products

- WNC WNC-M14A2A LTE-M modem driver unspecified

## Timeline

- 2026-08-17: disclosed