Executive brief
Zephyr's LoRaWAN fragmented data block transport handler contains an input validation flaw that allows an attacker with valid session keys to trigger an out-of-bounds read from adjacent memory. While the vulnerability requires authentication and has no direct data exposure path, it could potentially leak sensitive information from the device's memory or corrupt the FUOTA firmware image during reconstruction. This affects devices using LoRaWAN firmware-over-the-air (FUOTA) update functionality.
Technical details
The vulnerability is a buffer over-read in frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c. The handler parses downlink command bytes using only rx_pos < len as a bounds check, then casts rx_buf + rx_pos to a 10-byte structure and passes buffer pointers to the fragment decoder without validating sufficient payload bytes remain. An attacker holding the device's LoRaWAN session keys can craft a downlink with misaligned DATA_FRAGMENT filler commands to advance the read position without validation, causing the decoder to read up to ~frag_size bytes beyond the 255-byte RxPayload buffer into adjacent static memory. The over-read bytes are copied into decoder buffers and the FUOTA image, but are never returned to the sender, limiting direct confidentiality impact. The fix adds remaining-length guards before each buffer access.
Affected products
- Zephyr Project Zephyr <UNKNOWN>
Timeline
- 2026-08-26: disclosed: CVE-2026-13480 published
- 2026-08-26: advisory: NVD advisory entry