The software quietly managing power inside millions of connected devices contains a memory flaw that could hand an attacker control over hardware most users didn't even know existed.
Who's Affected — and Why It Matters
ASR Microelectronics' Kestrel platform is not a household name, but its fingerprints are everywhere. ASR supplies chipsets and associated firmware to device manufacturers building smartphones, IoT equipment, and connected industrial hardware across Asia, Europe, and North America. When a vulnerability lives at the firmware level — the invisible layer of code that wakes up before your operating system does — the blast radius extends to every device running unpatched software, regardless of what brand name is printed on the box.
The vulnerability, tracked as CVE-2026-42799, carries a CVSS score of 7.4 (HIGH) and affects all versions of the Kestrel platform released before February 10, 2026. Security teams managing device fleets — enterprise mobile, smart infrastructure, connected manufacturing — should treat this as a priority item. For everyday consumers, the practical question is simple: has your device manufacturer pushed a firmware update in the last few months? If not, ask why.
What an Attacker Can Actually Do
Think of your device's firmware as the building's electrical system — it runs behind the walls, most people never touch it, and almost nobody thinks about it until something goes wrong. Inside ASR's Kestrel firmware lives a module responsible for managing power control: deciding how much energy the device's radio hardware uses, when to ramp up signal strength, and when to dial back. It's unglamorous, essential, and — as it turns out — broken in a way that matters.
The flaw works like this: the power control module reads data from a section of memory, but it doesn't check carefully enough where that section ends. An attacker who can send specially crafted data to the device — through a malicious network packet, a rogue base station, or even a tampered update mechanism — can trick the module into reading memory it was never supposed to touch. That spilled-over read can expose sensitive data sitting nearby in memory, or be chained with other techniques to crash the device entirely and potentially execute attacker-controlled code.
What makes this particularly uncomfortable is the cross-platform nature of the vulnerability. This isn't a flaw in one app on one operating system that a user can simply delete. It lives below the operating system, in the firmware that ships baked into the hardware itself. A user has no way to "uninstall" their way out of this. The fix has to come from the manufacturer, distributed as a firmware update — a process that is notoriously slow, inconsistent, and often never completed for older or budget-tier devices.
The Technical Detail Security Researchers Need
The vulnerability originates in a specific source file: Code/Nr/nr_fw/RA/src/NrPwrCtrl.C, located within the nr_fw (New Radio Firmware) module of the Kestrel platform. The vulnerability class is an out-of-bounds read leading to buffer overflow — a memory corruption primitive that, under the right conditions, can be escalated from information disclosure to arbitrary code execution. The CVSS 7.4 score reflects high confidentiality and integrity impact with no required user interaction under certain attack vectors, making it a strong candidate for inclusion in proof-of-concept research targeting baseband attack surfaces.
What We Know About Exploitation So Far
As of publication, there is no confirmed active exploitation of CVE-2026-42799 in the wild. No threat actor groups have been publicly linked to campaigns leveraging this flaw, and no known victims have been reported. However, the security community's guidance is consistent and worth taking seriously: the absence of observed exploitation is not the same as the absence of exploitation. Baseband and firmware vulnerabilities have historically attracted attention from sophisticated nation-state actors and commercial spyware vendors precisely because they operate below the radar of conventional endpoint security tools. Antivirus software won't catch an attack happening at this level.
The vulnerability was disclosed through ASR's security advisory process. No independent security research group or bug bounty program has been publicly credited with the discovery at this time. The coordinated disclosure timeline, anchored to the February 10, 2026 patch date, suggests responsible reporting practices were followed — but the clock is now running for device manufacturers to push updates downstream to end users.
What You Should Do Right Now
There are three concrete steps worth taking immediately, whether you're a security professional managing a device fleet or a consumer who just wants to know they're safe.
- Update your firmware immediately if you're running ASR Kestrel-based hardware. The patched version is any Kestrel build dated 2026/02/10 or later. Navigate to your device's settings menu, find "System Update" or "Firmware Update," and check for available updates. If your manufacturer hasn't released a patch, contact their support channel directly and ask for a timeline. Document that request — it matters for compliance teams.
- Audit your device inventory for ASR Kestrel chipsets. Enterprise and security teams should cross-reference their hardware asset registers against ASR's affected product list. Pay particular attention to IoT devices, embedded systems, and budget mobile hardware where firmware update cycles are long or nonexistent. Devices that cannot receive patches should be flagged for network isolation or accelerated replacement planning.
- Apply network-level mitigations while patches are pending. Since attack vectors may include malicious network traffic, ensure exposed devices sit behind properly configured firewalls and that unnecessary remote management ports are closed. For high-risk environments, consider temporarily restricting devices' access to untrusted networks. Monitor security advisories from ASR directly at their official channels, as additional technical indicators or updated CVSS scoring may emerge as researcher scrutiny increases.
CVE: CVE-2026-42799 | CVSS: 7.4 (HIGH) | Platform: Cross-platform | Patch Deadline: Kestrel builds before 2026/02/10 are vulnerable | Active Exploitation: None confirmed