{"metadata": {"vulnerability": "CVE-2026-75085", "count": 10, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-08-17T16:17:49.267Z", "date_only": false, "value": "2026-08-17T16:17:49.267Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-75085", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T16:46:02.993Z", "date_only": false, "value": "2026-10-14T16:46:02.993Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-75085", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T16:46:02.993Z", "date_only": false, "value": "2026-10-14T16:46:02.993Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / zephyr", "record": "CVE-2026-75085", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T17:19:10.607Z", "date_only": false, "value": "2026-10-14T17:19:10.607", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-75085", "record": "FKIE_CVE-2026-75085", "field": "published"}, {"timestamp": "2026-10-14T22:16:59.804Z", "date_only": false, "value": "2026-10-14T22:16:59.804828Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441574952680504", "record": "CVE-2026-75085", "field": "creation_timestamp", "uuid": "7eb7a7fc-1585-4751-92c6-b42abb6a2cc5", "content": "CVE-2026-75085 Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the packet length of a received frame as pkt_len = rx_frame->length - IEEE802154_FCS_LENGTH without first checking that the radio-reported length could hold an FCS. pkt_len is a uint8_t, so a reported length of 0 or 1 wrapped to 254 or 255. The only bound on the resulting value was __ASSERT_NO_MSG(pkt_len <= CONFIG_NET_BUF_DATA_SIZE), which compiles to nothing in the default production configuration (CONFIG_ASSERT=n).\nThe length originates in the ST link-layer receive-done metadata (p_metadata->length, stored by stm32wba_802154_receive_done()), and ultimately in the PHY header of a frame received over the air, so it is influenced by any attacker within radio range of the device. Reaching the underflow requires the vendor link layer to surface a frame shorter than the FCS with no error; the driver performed no validation of its own on that value.\nWhen the underflow occurs, stm32wba_802154_rx_thread() calls net_pkt_write(pkt, rx_frame->psdu, pkt_len) with a length of about 254 bytes against a receive buffer that holds at most one PHY packet (IEEE802154_MAX_PHY_PACKET_SIZE, 127 bytes). This reads roughly 128 bytes past the end of the radio receive buffer and copies that adjacent memory into a network packet that is submitted to the networking stack, giving an out-of-bounds read with a potential disclosure of adjacent RAM plus needless oversized packet allocation in the RX thread.\nThe fix rejects a frame whose reported length is smaller than IEEE802154_FCS_LENGTH before the subtraction, and replaces the compiled-out assertion with a runtime length check that drops oversized frames \u2014 matching the runtime check already present in drivers/ieee802154/ieee802154_nrf5.c.\nhttps://www.cve.org/CVERecord?id=CVE-2026-75085https://github.com/zephyrproject-rtos/zephyr/commit/46f8af4f5ee472abc13b0291c44fdfe4ed879aaahttps://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w7pm-4r95-c9vr#zephyrproject #zephyr#CVE_2026_75085#bot", "url": "https://infosec.exchange/users/cve/statuses/117441574952680504"}, {"timestamp": "2026-10-16T15:23:46.554Z", "date_only": false, "value": "2026-10-16T15:23:46.554080Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-75085", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T15:23:46.554Z", "date_only": false, "value": "2026-10-16T15:23:46.554080Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-75085", "record": "FKIE_CVE-2026-75085", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T15:31:45.899Z", "date_only": false, "value": "2026-10-16T15:31:45.899Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-75085", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:31:45.899Z", "date_only": false, "value": "2026-10-16T15:31:45.899Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-75085", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T16:21:02.357Z", "date_only": false, "value": "2026-10-16T16:21:02.357", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-75085", "record": "FKIE_CVE-2026-75085", "field": "lastModified"}]}