The vulnerability is a heap‑based buffer overflow in the Morse Micro HaLowLink 2 "morse.ko" Wi‑Fi kernel driver. When a beacon frame containing a malformed Traffic Indication Map Information Element is processed, the driver copies the TIM bitmap without bounds checking, allowing up to 252 bytes of attacker‑controlled data to be written beyond the destination buffer. Writing beyond the buffer can trigger a kernel panic (denial of service) or, if the overflow leads to execution of attacker‑controlled code, remote code execution with kernel privileges.

Morse Micro HaLowLink 2 firmware versions prior to 2.11.13. The issue affects all systems running the HaLow Wi‑Fi kernel driver "morse.ko" on this platform. Devices that receive beacon frames in the same radio range as the target are vulnerable.

The flaw can be abused by anyone within radio range, as beacon frames are broadcast during passive scanning. The likely attack vector is the transmission of a crafted 802.11ah beacon frame containing a malformed TIM Information Element, which requires no authentication, association, or user interaction. The CVSS score of 9.8 highlights the critical severity, while the EPSS score of below 1% indicates a very low exploitation probability at this time, and the vulnerability is not listed in the CISA KEV catalog. Despite the low exploitation probability, the potential for kernel‑level remote code execution remains a substantial risk for affected devices.