A cumulative integer wrap‑around in the WiLCoW1000 WiFi driver causes a heap buffer overflow during SSID scanning. The driver stores the total size of SSIDs to be scanned in a u8 field, but up to ten SSIDs can collectively require 330 bytes. The 8‑bit counter wraps to 74, leading kmalloc to allocate only 75 bytes while a later memcpy writes up to 331 bytes, overwriting 256 bytes of heap memory. This out‑of‑bounds write can corrupt heap structures, potentially allowing an attacker to execute arbitrary code or induce a system crash.

The flaw exists in the wilc1000 driver bundled with the Linux kernel. Any Linux system that includes the module prior to the patch is vulnerable; the exact affected kernel release is not specified, so systems using the driver before the update are at risk.

No public CVSS or EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The overflow is considerable and can lead to remote code execution or denial of service, requiring an attacker to trigger a scan, which can be achieved by manipulating the wireless interface locally or by creating a malicious wireless environment that forces the device to scan. The severity warrants fast remediation.