Description
The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the configured decoder. In frag_transport_package_callback() the value frag_counter = hdr->frag_index_n & 0x3FFF is taken directly from the downlink payload and passed to the decoder, which derives an array index and flash offset as frag_counter - 1. DataFragment fragments are 1-indexed, so a frag_counter of 0 underflows that arithmetic.

With the default Semtech/LoRaMAC-node decoder, this reaches FragDecoder.FragNbMissingIndex[fragCounter - 1] = 0; in FragDecoderProcess(), where fragCounter - 1 evaluates to -1 and writes a uint16_t zero out of bounds, just before the array and into the adjacent MatrixM2B recovery-matrix state of the static decoder object (CWE-787). A companion write derives a wild flash offset, but that path is rejected by the flash_area_write() bounds check. The in-tree low-memory decoder (frag_dec()) is not corrupted: its out-of-range bit-array and flash accesses are caught by sys_bitarray_ and flash_area_ bounds checks.

The handler is the registered downlink callback for the fragmentation transport port, reachable whenever an active fragmentation session exists, so the triggering byte is attacker-influenceable LoRaWAN/FUOTA network input. Triggering it requires authenticated downlinks (LoRaWAN MAC session keys or a malicious/compromised network or FUOTA server) and an active fragmentation session. The impact is contained: corruption of decoder state and denial of the firmware-update (FUOTA) session rather than controllable memory corruption or code execution. The fix adds a transport-layer check that rejects frag_counter == 0, closing the defect for both decoder backends.
Published: 2026-08-14
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The LoRaWAN Fragmented Data Block Transport service does not verify the fragment counter in a DATA_FRAGMENT command before forwarding it to the decoder. A valid counter must start at 1, but an attacker can send a counter of 0. This underflows the arithmetic that derives an array index and flash offset, causing an out‑of‑bounds write on the decoder’s state. The write occurs into a static decoder object, corrupting the recovery‐matrix state and leading to a failed firmware‑update session. The flaw is an out‑of‑bounds write (CWE‑787) and does not enable arbitrary code execution, only causing disruption of the update process.

Affected Systems

Devices running the Zephyr Project operating system that use LoRaWAN fragmentation transport (subsys/lorawan/services/frag_transport.c). The vulnerability applies to any release that includes the protocol code without the transport‑layer check; the fix is found in commit 452c704a2836.

Risk and Exploitability

The CVSS score of 4.2 indicates a low severity. EPSS is unavailable and the vulnerability is not listed in CISA’s KEV catalog. An adversary must send an authenticated downlink packet containing a fragment index of 0 while a fragmentation session is active, which requires access to MAC session keys or a compromised network/FUOTA server. The attack vector is thus network‑based. Exploitation will corrupt decoder state and deny the firmware‑update session without permitting code execution.

Generated by OpenCVE AI on August 14, 2026 at 19:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Zephyr firmware to a release that includes commit 452c704a2836, which validates frag_counter values before forwarding them to the decoder.
  • Rebuild and redeploy the updated firmware to all devices that currently use LoRaWAN fragmentation transport.
  • If immediate patching is not feasible, temporarily disable the fragmentation transport feature or configure the network to block fragmented update packets until the system can be updated.

Generated by OpenCVE AI on August 14, 2026 at 19:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 14 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Fri, 14 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the configured decoder. In frag_transport_package_callback() the value frag_counter = hdr->frag_index_n & 0x3FFF is taken directly from the downlink payload and passed to the decoder, which derives an array index and flash offset as frag_counter - 1. DataFragment fragments are 1-indexed, so a frag_counter of 0 underflows that arithmetic. With the default Semtech/LoRaMAC-node decoder, this reaches FragDecoder.FragNbMissingIndex[fragCounter - 1] = 0; in FragDecoderProcess(), where fragCounter - 1 evaluates to -1 and writes a uint16_t zero out of bounds, just before the array and into the adjacent MatrixM2B recovery-matrix state of the static decoder object (CWE-787). A companion write derives a wild flash offset, but that path is rejected by the flash_area_write() bounds check. The in-tree low-memory decoder (frag_dec()) is not corrupted: its out-of-range bit-array and flash accesses are caught by sys_bitarray_ and flash_area_ bounds checks. The handler is the registered downlink callback for the fragmentation transport port, reachable whenever an active fragmentation session exists, so the triggering byte is attacker-influenceable LoRaWAN/FUOTA network input. Triggering it requires authenticated downlinks (LoRaWAN MAC session keys or a malicious/compromised network or FUOTA server) and an active fragmentation session. The impact is contained: corruption of decoder state and denial of the firmware-update (FUOTA) session rather than controllable memory corruption or code execution. The fix adds a transport-layer check that rejects frag_counter == 0, closing the defect for both decoder backends.
Title Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-14T19:26:51.474Z

Reserved: 2026-06-16T03:53:41.904Z

Link: CVE-2026-12363

cve-icon Vulnrichment

Updated: 2026-08-14T19:26:47.155Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-14T18:17:21.697

Modified: 2026-08-26T16:59:23.267

Link: CVE-2026-12363

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T20:00:05Z

Weaknesses