External risk intelligence

Morse Micro HaLowLink Kernel Driver Heap Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-7762

This vulnerability affects a Wi-Fi kernel driver (dot11ah.ko) and requires an attacker to be physically present within radio range to transmit crafted 802.11ah frames. It is not reachable over the public internet, as it relies on short-range wireless proximity.

Remote Code Execution

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recently identified vulnerability exists in a specific Wi-Fi kernel driver, potentially impacting devices utilizing Morse Micro HaLowLink 2 software. This issue could allow an unauthenticated attacker within radio range to disrupt services or, in a worst-case scenario, execute malicious code by sending specially crafted wireless frames. The primary concern is to determine if this technology is present within your environment and assess the potential exposure.

Wireless driver flaw may allow remote disruption.
Matters if HaLow Wi-Fi technology is in use.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker within radio range can send specially crafted wireless frames to a vulnerable device. The device's Wi-Fi driver processes these frames, leading to a buffer overflow. This overflow can overwrite critical memory, potentially causing a system crash or allowing the attacker to execute their own code.

Attacker needs to be within radio range.
Malformed Wi-Fi beacon or probe response frame.
Denial of service or remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A heap-based buffer overflow in a Wi-Fi kernel driver could allow an attacker within radio range to crash the system or potentially execute code by sending a specially crafted wireless frame. This could occur during normal scanning operations, without requiring authentication or user interaction.

Kernel memory and code integrity.
Malformed wireless frames sent wirelessly.
System instability or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical heap-based buffer overflow vulnerability impacts the Morse Micro HaLowLink 2 software, specifically its dot11ah.ko kernel driver. Responsibility for addressing this issue likely falls to the infrastructure or platform teams managing the affected hardware, alongside the security and vendor management teams due to the nature of the driver and the potential for code execution. The first practical step is to inventory all deployed Morse Micro HaLowLink 2 devices, confirm their radio-range exposure, and assess their business criticality to prioritize remediation efforts, which may involve coordinating with the vendor for a fix or implementing compensating controls.

Identify affected Morse Micro devices.
Verify radio-range exposure and criticality.
Plan vendor-supported remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Morse Micro HaLowLink 2 software?

HaLowLink 2 is the software stack that powers devices using Morse Micro's HaLow technology. This specialized Wi-Fi standard is designed for long-range, low-power connectivity in Internet of Things (IoT) applications. The software includes kernel drivers, such as the dot11ah.ko component, which manage how the hardware transmits and receives wireless signals to communicate with other sensors or base stations.

What does this heap-based buffer overflow mean in CVE-2026-7762?

This is a memory corruption flaw. It occurs because the driver fails to check if the data it receives from an incoming wireless frame fits into its assigned memory space. When a malformed signal provides more data than expected, it spills over into adjacent memory. This overflow can overwrite system instructions, which may cause the software to crash or allow an attacker to hijack the system by running their own unauthorized commands.

How does an attacker trigger this vulnerability?

The vulnerability is triggered when a device processes a maliciously crafted 802.11ah beacon or probe response frame. The attacker must be within physical radio range of the targeted device to transmit these signals. Importantly, the flaw is triggered automatically during the device's standard background scanning process; it does not require the user to interact with the device or successfully associate with a network to succeed.

Is CVE-2026-7762 reachable over the public internet?

No, Halo Surface Signal indicates this is very unlikely. Because the vulnerability is tied to the physical Wi-Fi radio driver, an attacker must be physically present in the immediate vicinity to transmit the necessary wireless frames. It cannot be triggered by remote attackers sending packets over the standard internet, as the attack is constrained by the radio frequency range of the HaLow hardware.

What should I do if I use Morse Micro HaLowLink 2?

First, create an inventory of all devices in your environment running Morse Micro HaLowLink 2 software versions earlier than 2.11.13. Once you identify these assets, assess where they are physically deployed to understand if they are in locations where an unauthorized person could get within radio range. Contact your hardware vendor to obtain the necessary firmware or software updates that resolve the driver defect and apply them as soon as possible.

References

www.morsemicro.com/security-advisories/MM-SA-2026-002

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.