# CVE-2026-75083: NXP KW41Z IEEE 802.15.4 driver buffer overflow in receive path

Source: https://junglewise.ai/threats/cve-2026-75083-the-receive-path-of-the-nxp-kw41z-ieee-802-15-4-driver-kw41z-rx  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-75083 · Severity: medium · CVSS 5.9 · Published 2026-10-14

The NXP KW41Z wireless driver for IEEE 802.15.4 (a short-range wireless protocol used in IoT devices) improperly validates frame length fields in received packets. An attacker within radio range can send malformed frames that cause the driver to write received data beyond allocated buffer boundaries, corrupting memory and potentially crashing the device or corrupting data from other wireless connections.

Vendors: [NXP](https://junglewise.ai/threats/vendors/nxp).

## Quick answers

**Is CVE-2026-75083 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75083 being exploited in the wild.

**How severe is CVE-2026-75083?** Medium severity, with a CVSS score of 5.9, published 14 October 2026.

**Which products and versions are affected?** NXP KW41Z IEEE 802.15.4 driver prior to fix.

**Is there a fix for CVE-2026-75083?** Yes: fixed in The fix rejects any length below KW41Z_FCS_LENGTH and verifies net_buf_tailroom() of the first fragment before copy loops. Until then: Restrict IEEE 802.15.4 radio reception to trusted devices by configuring frame filtering or disabling the wireless interface if not actively in use; apply firmware updates as provided by NXP once available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75083 attacked?** It is attacked over the network or from the adjacent network, in device firmware.

**Am I affected by CVE-2026-75083?** Check whether you run NXP KW41Z IEEE 802.15.4 driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in The fix rejects any length below KW41Z_FCS_LENGTH and verifies net_buf_tailroom() of the first fragment before copy loops

Restrict IEEE 802.15.4 radio reception to trusted devices by configuring frame filtering or disabling the wireless interface if not actively in use; apply firmware updates as provided by NXP once available.

## Technical details

The kw41z_rx() function in drivers/ieee802154/ieee802154_kw41z.c computes payload size by subtracting KW41Z_FCS_LENGTH from an untrusted uint8_t length field without proper bounds checking, allowing underflow when the reported length is one. This results in a 255-byte write into a 128-byte buffer, with the overflow occurring from interrupt context into adjacent network buffer pool memory and unvalidated reads from radio hardware registers.

## Affected products

- NXP KW41Z IEEE 802.15.4 driver prior to fix

## Timeline

- 2026-10-14: disclosed