An out-of-bounds write occurs when a crafted SPI host command contains an oversized length field, allowing the firmware to write up to 254 arbitrary bytes past the bounds of an internal non‑persistent memory buffer. This buffer overflow can corrupt critical in‑memory data and cause the device to behave unpredictably, as defined by CWE‑787.

Semtech LR1110, LR1120, and LR1121 product families, including both Modem‑e and Transceiver variations, are impacted by the LR11xx firmware flaw. The advisory does not list specific firmware revisions, so all current releases may be vulnerable until a corrected firmware is distributed.

The CVSS score of 5.2 reflects moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. The description specifies that exploitation requires physical access to the device and logical access to the SPI bus, indicating a local attack vector. While physical access limits the potential attack surface, any environment where devices are accessible in the field should evaluate the risk of device compromise.