The vulnerability originates in the STM32WBA IEEE 802.15.4 driver where the received‑frame length is calculated without guarding against an underflow. A radio report of length 0 or 1 causes the 8‑bit subtraction to wrap, producing a packet length of 254 or 255 bytes. This value is then used to read from the radio buffer in an out‑of‑bounds fashion, copying up to 128 bytes beyond the allocated receive space into the network stack. The result is a read of adjacent RAM that can expose sensitive information and allocates an oversized network packet, leading to memory‑disclosure risk and inefficient resource use.

All instances of Zephyr OS that include the STM32WBA IEEE 802.15.4 driver, specifically the source file drivers/ieee802154/ieee802154_stm32wba.c, are affected. Devices built with Zephyr before the fix must be updated. No specific version numbers are listed, so any Zephyr release prior to the commit that introduced the length check is considered vulnerable.

The CVSS score of 4.2 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker needs to be within radio range of the target device and able to inject a packet containing an underflow‑producing length value; this can be achieved with a radio capable of driving the target’s 802.15.4 interface. Once the condition is triggered, an out‑of‑bounds read occurs, potentially leaking data from the device’s memory but not allowing arbitrary code execution. The exploit therefore raises confidentiality risk but does not affect integrity or availability directly. The lack of defensive assertions in production builds lowers the detection likelihood, while the ability to validate the frame length at runtime mitigates the risk if enabled.