CVE-2026-42799 is an out of bounds read (CVSS 7.4, high) in the nr_fw modules of ASR Kestrel, the platform behind the ASR1803 chipset. It affects Kestrel builds before 2026/02/10. Chip customers should ask their device or module vendor which firmware carries the fix.
What's affected
The record says the issue affects Kestrel before 2026/02/10, in the file Code/Nr/nr_fw/RA/src/NrPwrCtrl.C. It lists the ASR1803 and ASR1803 firmware as products.
Kestrel is chipset software, so the product you actually run is probably a modem, router or IoT module from another company. The vendor PSIRT page named in the record is the starting point, and I could not read it when preparing this guide, so I cannot confirm more detail.
How to check if you're exposed
- List devices in your estate that use an ASR1803 based cellular or 5G module. Your hardware inventory or the device maker's datasheet will say.
- Ask the maker which firmware build includes the Kestrel update dated 2026/02/10 or later.
- Read the firmware version on each device and compare it with that build.
- Note which devices are reachable over a cellular or wide area link, since the vector is network based.
What to do now
- Read the ASR PSIRT notice and contact your module or device vendor for a firmware update.
- Apply the update through your normal firmware process, testing on a small group first.
- Keep management interfaces for these devices off public networks.
- Record the module, firmware version and update date in your asset inventory.
- Ask vendors in future to list upstream chipset advisories in their release notes.
Why it matters
The weakness is CWE-125, out of bounds read. Firmware reads memory outside the buffer it should be using. Reads of this kind can expose data or crash the component, and they sometimes give an attacker information for a later step.
The vector requires low privileges, and the scope is changed, meaning the impact can pass beyond the vulnerable component. The record gives no details about exploitation. The KEV flag is false. The practical difficulty is the supply chain: the fix is made at the chip level and reaches you only when your device vendor ships it.
Quick check
Can I patch this myself?
Not usually. Kestrel is firmware inside chipsets, so the fix reaches you through updated firmware from the device or module maker.
Sources
Last reviewed: 19 October 2026.
