Read the docs
TI-2026-85718 Aliases CVE-2026-89142GHSA-787f-mx37-7v2r

Out-of-bounds write in Airoha Wi-Fi NPU firmware

Priority LOW 27CWE-787Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Airoha Technology Corp. Wi-Fi NPU firmware in EN7529, AN7552, AN7581 and AN7583 is affected through TLB7.8.0.0_v006. A faulty bounds check lets a write go outside the intended memory (CWE-787). A local user with normal execution privileges can cause a denial of service, and no user interaction is needed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In the Wi-Fi NPU FW, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local denial of service with user execution privileges needed. User interaction is not needed for exploitation.

Why it matters now

EPSS 0.00225 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Airoha Technology Corp.EN7529, AN7552, AN7581, AN7583 (Wi-Fi NPU Firmware)up to TLB7.8.0.0_v006—No fix listedCNA
  • EN7529, AN7552, AN7581, AN7583 (Wi-Fi NPU Firmware) VendorAiroha Technology Corp. Affected up to TLB7.8.0.0_v006 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for EN7529, AN7552, AN7581, AN7583 (Wi-Fi NPU Firmware).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-89142
  2. 2026-11-06 Affected versions changed · CNA
  3. 2026-11-06 Alias added: GHSA-787f-mx37-7v2r
  4. 2026-11-06 Affected versions changed · CNA
  5. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2025-14771 Missing authentication in Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series… CVSS 3.1HIGH 8.8
  • TI-2025-14770 Incorrect authorization in Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series CVSS 3.1HIGH 8.8
  • TI-2025-14769 Missing authentication in Airoha Technology Corp. AB156x, AB157x, AB158x, AB159x series… CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences