The vulnerability arises from an unsigned 8‑bit integer overflow in the Wilc1000 Wi‑Fi driver. The driver accumulates the total size of SSIDs it scans in a variable declared as u8, which can hold values up to 255. Ten SSIDs of up to 33 bytes each require 330 bytes, causing the counter to wrap to 74. Consequently, kmalloc allocates only 75 bytes, while a later memcpy writes up to 331 bytes into the buffer, corrupting 256 bytes of heap memory. This overflow can compromise memory integrity and potentially allow arbitrary code execution or denial of service.

The flaw exists in the Wilc1000 driver shipped with the Linux kernel. Because specific kernel version numbers are not given, any system that loads the unpatched module is susceptible. This includes all Linux deployments with the Wilc1000 hardware driver active before the upstream fix is integrated.

The reported CVSS score of 7.8 indicates a high severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting low current exploitation likelihood. Based on the description, it is inferred that triggering a Wi‑Fi scan can lead to the overflow, which may occur locally via user actions or by positioning a malicious access point that forces the device to scan. Because the overflow undermines heap state, a successful exploit could lead to arbitrary code execution or system crash.