Read the docs
TI-2026-85339 Aliases CVE-2026-123011GHSA-hxxf-v8p5-g347

st-mems-android-linux-sensors-hal does not check allowed channel count

Priority LOW 19CWE-1284Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded. The missing check (CWE-1284) lets input specify more channels than permitted. An unauthenticated attacker on an adjacent network can trigger the flaw, with a limited effect on integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.

Why it matters now

EPSS 0.00177 7th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

No affected products listed by the sources yet.

Remediation

The sources list no fixed version for st-mems-android-linux-sensors-hal.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123011
  2. 2026-11-05 Alias added: GHSA-hxxf-v8p5-g347

References

Other 1

  • TI-2023-27386 STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an… CVSS 3.1HIGH 7.5
  • TI-2019-10597 On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices… CVSS 3.1CRITICAL 9.8
  • TI-2024-30175 Memory corruption in STMicroelectronics X-CUBE-AZRT-H7RS CVSS 3.1CRITICAL 9.8
  • TI-2021-18838 STM32 USB Host Library Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2020-06476 STMicroelectronics STM32F1 devices have Incorrect Access Control. CVSS 3.1HIGH 7.5
  • TI-2024-34024 Integer underflow in STMicroelectronics X-CUBE-AZRT-H7RS CVSS 3.1HIGH 7.5
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences