A malformed Wi‑Fi power‑save event caused by the nRF70 co‑processor firmware copies an unbounded number of TWT (Target Wake Time) flow entries into a fixed eight‑element array supplied by the host stack. The missing bounds checks result in an out‑of‑bounds write of roughly 40 bytes per overflowed entry, which can corrupt stack memory of the caller and may lead to a crash, data loss, or, if an attacker can arrange a suitable event payload, arbitrary code execution. Based on the description, it is inferred that the absence of validation allows the host to overwrite memory beyond the intended buffer. The CWE identified is 787, signifying a classic out‑of‑bounds write vulnerability. This flaw is categorized with a CVSS score of 5, indicating moderate severity.

The issue affects Zephyr Project builds that enable the nRF70 STA mode (CONFIG_NRF70_STA_MODE) on releases through v4.4.0. Any host‑side software that relies on the power‑save event handling in drivers/wifi/nrf_wifi/src/wifi_mgmt.c and receives events from the nRF70 co‑processor could be susceptible. Typical victims include embedded devices running Zephyr and interacting with an nRF70 Wi‑Fi module for power‑save functions. Based on the description, it is inferred that the vulnerability impacts any host configuration that processes power‑save events from the nRF70 co‑processor.

The vulnerability requires the co‑processor firmware to emit a malformed or out‑range event, so the attack surface is confined to the host‑to‑trusted‑coprocessor boundary and not a direct remote code injection from an external Wi‑Fi access point. The EPSS score is less than 1 %, indicating a very low chance of exploitation. Nonetheless, the possibility of memory corruption can lead to denial of service, and in a permissive environment the overflow could be leveraged for arbitrary code execution if the attacker has control over the event payload. Security teams should therefore assess the risk based on whether the device processes power‑save events from potentially untrusted firmware and whether the configuration allows co‑processor interaction.