The vulnerability is an out-of-bounds read/write in Zephyr's WNC-M14A2A modem driver when it parses unsolicited %NOTIFYEV lines. The driver copies a line into a 40-byte stack buffer with a hard cap of 39 bytes before returning from net_buf_linearize, yet the quote-delimiter loops continue to process the full frame length. As a result, the loops can read past the 39-byte boundary and write a single null byte beyond the stack buffer, leaking adjacent memory content and potentially corrupting the modem receive thread. The crash manifests as a denial of service; the exploit does not currently demonstrate privilege escalation or arbitrary code execution.

The flaw exists in the Zephyr Project's Zephyr RTOS, specifically within the WNC-M14A2A LTE-M modem driver. No specific version range was supplied, so any Zephyr build that includes the affected driver code is potentially vulnerable. Embedded systems with LTE-M modems that compile the Zephyr kernel are at risk, especially those that rely on unsolicited %NOTIFYEV events for real-time network information.

The CVSS score of 5.0 indicates a moderate risk level, but the EPSS score is unavailable and the vulnerability is not listed in CISA's KEV catalog. Attackers can trigger the flaw by making the modem receive an over-long %NOTIFYEV line through a rogue base station, a compromised modem module, or RF manipulation; no additional application interaction is required. Because the off-by-buffer write is only weakly controlled, the main threat is service interruption rather than confidentiality or integrity compromise.