CVE-2026-7763
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon frame containing a malformed Traffic Indication Map (TIM) Information Element. The function morse_page_slicing_process_tim_element() in page_slicing.c derives the TIM bitmap length directly from a received IE field without validating it against the fixed-size destination buffer before passing it to memset and memcpy operations, allowing up to 252 bytes of attacker-controlled data to be written beyond the buffer boundary. Because beacons are broadcast frames processed during passive scanning, no authentication, association, or user interaction is required.
Risk Assessment
An unauthenticated attacker within Wi-Fi range can cause a system crash or remotely execute code, leading to full device compromise.
Recommendation
Update Morse Micro HaLowLink 2 software to version 2.11.13 or later that fixes this vulnerability.
Other vulnerabilities in Morse Micro HaLowLink 2
See all- CVE-2026-7762Critical
The HaLow Wi-Fi kernel driver (dot11ah.ko) in Morse Micro HaLowLink 2 software before version 2.11.13 contains a heap-based buffer overflow that can be exploited by an unauthenticated attacker within radio range to cause a kernel panic or remote code execution via a crafted beacon or probe response frame.
- CVE-2026-7764Medium
Out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink software before 2.11.12. An unauthenticated attacker within radio range can disclose a small amount of kernel heap memory or cause DoS (kernel oops/panic) via a crafted 802.11ah beacon or probe response with a malformed Vendor Information Element. The function morse_vendor_find_vendor_ie() does not validate IE length, leading to an out-of-bounds read of up to 9 bytes. No authentication or user interaction required.
Original NVD description (English source)
A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon frame containing a malformed Traffic Indication Map (TIM) Information Element. The function morse_page_slicing_process_tim_element() in page_slicing.c derives the TIM bitmap length directly from a received IE field without validating it against the fixed-size destination buffer before passing it to memset and memcpy operations, allowing up to 252 bytes of attacker-controlled data to be written beyond the buffer boundary. Because beacons are broadcast frames processed during passive scanning, no authentication, association, or user interaction is required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS