CVE-2026-12520: HL7800 Modem Buffer Overflow Vulnerability

CVE-2026-12520 Overview

CVE-2026-12520 is a stack buffer overflow in the Zephyr RTOS Sierra Wireless HL7800 cellular modem driver. The affected code resides in drivers/modem/vendor_standalone/hl7800.c (previously drivers/modem/hl7800.c in v4.4.0 and earlier). Roughly twenty AT-response handlers call net_buf_linearize() into a 128-byte stack buffer and append a NUL terminator without accounting for the return value equaling the destination length. The +KCELLMEAS handler on_cmd_atcmdinfo_rssi() compounds the flaw by passing the wire length as the destination size, enabling a full overflow of attacker-influenceable content into kernel stack memory.

Critical Impact
An adjacent attacker capable of shaping cellular modem output can trigger kernel-context memory corruption, ranging from reliable device crash to arbitrary code execution.

Affected Products

Zephyr RTOS versions 4.4.0 and earlier containing the Sierra Wireless HL7800 driver
Embedded devices integrating the HL7800 cellular modem via the Zephyr modem subsystem
Firmware builds using drivers/modem/hl7800.c or drivers/modem/vendor_standalone/hl7800.c

Discovery Timeline

2026-08-18 - CVE-2026-12520 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-12520

Vulnerability Analysis

The defect is an out-of-bounds write [CWE-787] in AT-command response parsing. Approximately twenty handlers invoke net_buf_linearize(value, sizeof(value), *buf, 0, len) into a 128-byte stack buffer value[128], then execute value[out_len] = 0 to NUL-terminate. Because net_buf_linearize() in lib/net_buf/buf.c can return a count equal to its destination-length argument, a field that exactly fills the buffer causes the terminator to land one byte past the end. This produces a single-byte out-of-bounds write into adjacent stack memory.

The +KCELLMEAS cell-measurement handler is materially worse. The call site passes the wire length len as the destination size: net_buf_linearize(value, len, *buf, 0, len). A response line exceeding 128 bytes overflows value with attacker-influenceable content. The line length is produced by net_buf_findcrlf(), which walks the entire net_buf fragment chain without a 128-byte bound.

Root Cause

The root cause is a missing bounds reconciliation between net_buf_linearize()'s return semantics and the fixed-size stack buffer. The safe idiom is sizeof(dst) - 1 to reserve space for the terminator. The +KCELLMEAS path further conflates source and destination lengths, removing the bound entirely.

Attack Vector

Input originates from the cellular modem over UART and reflects network-controlled data: operator-scan results, +CGCONTRDP IP/DNS information, socket indications, and +KCELLMEAS neighbour-cell reports. An attacker operating a rogue base station, a compromised modem baseband, or a remote peer influencing response framing can drive a line past 128 bytes. The handlers execute in the driver's RX thread in kernel context, so corruption occurs kernel-side. Exploitation requires precise control over modem output framing, yielding high attack complexity over an adjacent (cellular radio) vector.

No verified proof-of-concept code is available. See the GitHub Security Advisory for the maintainer's technical analysis.

Detection Methods for CVE-2026-12520

Indicators of Compromise

Unexpected Zephyr kernel panics, faults, or reboots correlated with cellular modem activity, especially during network scans or handover events
Anomalous +KCELLMEAS, +CGCONTRDP, or operator-scan AT responses exceeding typical field lengths on the UART channel between the SoC and HL7800 modem
Presence of unauthorized or unexpected base stations in cellular scan logs from affected devices

Detection Strategies

Instrument the modem UART with a bus analyzer or in-firmware logger to identify AT response lines exceeding 128 bytes
Add assertion or bounds-check hooks around net_buf_linearize() call sites in hl7800.c during test builds to flag boundary conditions
Correlate device crash telemetry with cell-tower changes to detect rogue base station exposure

Monitoring Recommendations

Forward device crash dumps and modem event logs to a centralized data lake for cross-fleet anomaly analysis
Baseline normal AT-response length distributions per handler and alert on outliers
Track firmware versions across the deployed fleet to identify unpatched Zephyr builds

How to Mitigate CVE-2026-12520

Immediate Actions Required

Update Zephyr to a version containing commit ea91f9375677aa4268e4044e096902dbe789f101, which corrects the bounds passed to net_buf_linearize()
Rebuild and redeploy device firmware for all products integrating the HL7800 driver
Audit downstream forks of hl7800.c for the same pattern and apply equivalent fixes

Patch Information

The upstream fix passes sizeof(dst) - 1 for the standard handlers and applies correct explicit bounds for the IMSI and +KCELLMEAS sites, ensuring the NUL terminator always lands within the destination buffer. See the GitHub Commit Update for the full diff.

Workarounds

Restrict device operation to trusted cellular networks where feasible, reducing exposure to rogue base stations
Disable or limit use of the +KCELLMEAS neighbour-cell reporting feature if the application does not require it
Add a defensive length check before invoking vulnerable handlers to cap AT response lines at 127 bytes until the patch is deployed

bash

# Update Zephyr west manifest to a fixed revision and rebuild
west update
west build -b <board> -p always <application>