# CVE-2026-6232: Semtech LR11xx out-of-bounds write in SPI command interface

Source: https://junglewise.ai/threats/cve-2026-6232-an-out-of-bounds-write-vulnerability-in-the-spi-host-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-6232 · Severity: info · Published 2026-10-12

Semtech's LR11xx LoRa transceivers contain a vulnerability in their firmware's SPI command interface that allows writing data beyond allocated memory boundaries. An attacker with physical access to the device and access to its SPI bus could exploit this to write up to 254 bytes of arbitrary data, potentially disrupting firmware operation or enabling further attacks on the wireless module.

Vendors: [Semtech](https://junglewise.ai/threats/vendors/semtech).

## Quick answers

**Is CVE-2026-6232 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6232 being exploited in the wild.

**How severe is CVE-2026-6232?** Informational severity, published 12 October 2026.

**Which products and versions are affected?** Semtech LR11xx transceiver firmware.

**Is there a fix for CVE-2026-6232?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6232 attacked?** It is attacked with physical access, in device firmware.

**Am I affected by CVE-2026-6232?** Check whether you run Semtech LR11xx transceiver firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists in the SPI host command interface where an oversized length field in a crafted SPI command causes the firmware to write up to 254 arbitrary bytes past the bounds of an internal non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus; this cannot be exploited remotely. The vulnerability affects the transceiver firmware's command parsing.

## Affected products

- Semtech LR11xx transceiver firmware

## Timeline

- 2026-10-12: disclosed

## References

- [https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-002-lr11xx-security-advisory](https://www.semtech.com/company/security/security-bulletins/sem-psa-2026-002-lr11xx-security-advisory)