External risk intelligence

Morse Micro HaLowLink Kernel Driver Heap Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-7763

The vulnerability exists in a Wi-Fi kernel driver requiring the attacker to be within radio range to inject malicious beacon frames. While this allows for unauthenticated interaction, it is restricted by physical proximity and specific wireless protocol deployment, making it less universally exposed than traditional internet-facing web services or APIs.

Remote Code Execution

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in the HaLow Wi-Fi kernel driver, potentially impacting devices utilizing Morse Micro HaLowLink 2 software. This issue, stemming from a heap-based buffer overflow, could allow an attacker within radio range to disrupt device operations or execute malicious code by sending specially crafted wireless signals. The primary concern is to confirm if our environment uses the affected technology and assess any potential exposure.

Wireless driver flaw allows nearby disruption.
Crucial to verify if our systems are affected.
Confirm relevance and exposure to this threat.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker within radio range can exploit this vulnerability by sending a specially crafted Wi-Fi beacon frame. This frame targets a weakness in how the kernel driver processes beacon information, potentially leading to system instability or remote code execution without requiring any prior connection or user interaction.

Attacker must be within radio range.
Malicious beacon frame triggers buffer overflow.
Denial of service or remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A heap-based buffer overflow in the morse.ko kernel driver could allow an unauthenticated attacker within radio range to crash the system or potentially execute code. This occurs when the driver processes a crafted Wi-Fi beacon frame with a malformed element, leading to data being written beyond its intended buffer. As beacons are broadcast and processed during passive scanning, no authentication, association, or user interaction is needed.

Kernel driver and Wi-Fi functionality.
Malformed beacon frames overwriting memory.
Denial of service or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The morse.ko HaLow Wi-Fi kernel driver is likely managed by the infrastructure or platform team responsible for wireless network services. The first practical step is to identify all deployed instances of this driver, determine their reachability and business criticality, and then engage the accountable owner to plan remediation.

Infrastructure or platform teams own the issue.
Verify affected device inventory and exposure.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Morse Micro HaLowLink 2 software?

Morse Micro HaLowLink 2 is software that powers HaLow Wi-Fi communication. HaLow is a low-power, long-range wireless standard based on 802.11ah, designed for IoT devices that need to cover large areas or penetrate obstacles. The affected morse.ko component functions as the kernel driver, which handles the low-level wireless signaling and data transmission between the hardware radio and the device's operating system.

What is the vulnerability in CVE-2026-7763?

This CVE describes a heap-based buffer overflow. In programming terms, this means the driver software tries to write more data into a fixed-size area of computer memory than it can hold. Because the driver fails to check if the incoming data fits, the excess data spills into adjacent memory. An attacker can use this flaw to overwrite critical system instructions, which could lead to a system crash or allow them to run unauthorized code on the device.

How does an attacker trigger this vulnerability?

An attacker triggers this by broadcasting a malicious 802.11ah Wi-Fi beacon frame. The vulnerability is specifically triggered during the device's passive scanning process, where it listens for available networks. It does not require a successful Wi-Fi connection, authentication, or even an association with an access point. Simply being within radio range while the device is scanning is sufficient to deliver the malformed data that causes the overflow.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal classifies this as a possible risk. While the vulnerability allows unauthenticated access, it is constrained by physics: the attacker must be within radio range to transmit the malicious signal. This differs from internet-facing services that can be attacked from anywhere globally. Your risk depends on whether your infrastructure is deployed in a location where an unauthorized party can physically get close enough to inject these wireless frames.

How should I respond to this threat advisory?

The priority is to conduct an inventory of systems running Morse Micro HaLowLink 2 software prior to version 2.11.13. Once you identify these devices, work with your infrastructure or platform teams to confirm which ones are in physical environments where wireless signals could be intercepted by unauthorized actors. Finally, coordinate with the vendor to obtain and apply the necessary software updates to patch the vulnerable driver.

References

www.morsemicro.com/security-advisories/MM-SA-2026-001

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.