Description
The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rx_pos < len; after consuming the one-byte command id the handler cast rx_buf + rx_pos to a 10-byte struct frag_transport_setup_req, and for a DATA_FRAGMENT command passed &rx_buf[rx_pos] to the fragment decoder, which reads exactly ctx.frag_size bytes — with no remaining-length check in either case.

The fragment size is attacker-chosen in a preceding FRAG_SESSION_SETUP command (ctx.frag_size = req->frag_size, capped at CONFIG_LORAWAN_FRAG_TRANSPORT_MAX_FRAG_SIZE, default 232). rx_buf aliases the 255-byte static MacCtx.RxPayload buffer in the loramac-node MAC layer, while len is the actual decrypted payload length. By padding a downlink with mismatched-index DATA_FRAGMENT filler commands (each advancing rx_pos by three bytes without producing an answer) and appending one matching-index fragment near the end of the payload, an attacker can make the decoder read up to roughly frag_size bytes past the end of RxPayload, copying adjacent static memory into the decoder buffers and the FUOTA flash image.

The handler runs only on downlinks that have already passed the LoRaWAN frame MIC and FRMPayload decryption, so the defect is reachable only by a party holding the device's session keys (the FUOTA server or an attacker who has compromised those keys). The out-of-bounds bytes are never returned to the sender — the only uplink emitted is a status answer carrying fragment counts — so there is no direct disclosure channel, and on typical flat-memory LoRaWAN MCUs the over-read stays within mapped memory, making a crash unlikely. The impact is therefore a bounded out-of-bounds read with limited confidentiality consequence and no write or control-flow primitive. The fix adds remaining-length guards before each access.
Published: 2026-08-26
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Out-of-bounds read
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an out‑of‑bounds read in the LoRaWAN TS004 Fragmented Data Block Transport handler for downlink commands. A malicious FUOTA server that can supply session‑key protected messages can craft payloads that cause the decoder to read up to the configured fragment size beyond the end of the received packet, copying adjacent static memory into the FUOTA flash image buffer. While the read does not return data to an attacker and typically does not trigger a crash, it represents a bounded disclosure of local memory content and can be used to infer sensitive information if the memory region contains secrets.

Affected Systems

The flaw exists in the Zephyr Project's Zephyr RTOS, specifically in the LoRaWAN subsystem file subsys/lorawan/services/frag_transport.c. No specific version range is listed in the advisory, so any build that includes this handler without the fix is considered vulnerable until the patch from commit 237309ea7c46ce85cedebf33dfea639aa2f5e2ca is applied.

Risk and Exploitability

The CVSS score is 3.1, indicating a low severity. There is no available EPSS score and the vulnerability is not listed in CISA KEV. Exploitation requires possession of the device's session keys, meaning only the legitimate FUOTA server or an attacker that has compromised the keys can trigger the defect. The lack of a direct disclosure channel and the absence of a write or control‑flow primitive make the risk modest, but the presence of a read allow potential inference of sensitive data, so patching is recommended.

Generated by OpenCVE AI on August 26, 2026 at 16:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Zephyr patch from commit 237309ea7c46ce85cedebf33dfea639aa2f5e2ca or upgrade to the latest stable release.
  • If patch cannot be applied immediately, rotate the device session keys to limit the window during which an attacker can construct malicious downlinks.
  • Monitor uplink traffic for abnormal FUOTA fragment responses that may indicate misuse.

Generated by OpenCVE AI on August 26, 2026 at 16:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*

Wed, 26 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Wed, 26 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Description The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rx_pos < len; after consuming the one-byte command id the handler cast rx_buf + rx_pos to a 10-byte struct frag_transport_setup_req, and for a DATA_FRAGMENT command passed &rx_buf[rx_pos] to the fragment decoder, which reads exactly ctx.frag_size bytes — with no remaining-length check in either case. The fragment size is attacker-chosen in a preceding FRAG_SESSION_SETUP command (ctx.frag_size = req->frag_size, capped at CONFIG_LORAWAN_FRAG_TRANSPORT_MAX_FRAG_SIZE, default 232). rx_buf aliases the 255-byte static MacCtx.RxPayload buffer in the loramac-node MAC layer, while len is the actual decrypted payload length. By padding a downlink with mismatched-index DATA_FRAGMENT filler commands (each advancing rx_pos by three bytes without producing an answer) and appending one matching-index fragment near the end of the payload, an attacker can make the decoder read up to roughly frag_size bytes past the end of RxPayload, copying adjacent static memory into the decoder buffers and the FUOTA flash image. The handler runs only on downlinks that have already passed the LoRaWAN frame MIC and FRMPayload decryption, so the defect is reachable only by a party holding the device's session keys (the FUOTA server or an attacker who has compromised those keys). The out-of-bounds bytes are never returned to the sender — the only uplink emitted is a status answer carrying fragment counts — so there is no direct disclosure channel, and on typical flat-memory LoRaWAN MCUs the over-read stays within mapped memory, making a crash unlikely. The impact is therefore a bounded out-of-bounds read with limited confidentiality consequence and no write or control-flow primitive. The fix adds remaining-length guards before each access.
Title Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler
Weaknesses CWE-125
CWE-20
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-26T15:45:14.744Z

Reserved: 2026-06-27T13:33:56.478Z

Link: CVE-2026-13480

cve-icon Vulnrichment

Updated: 2026-08-26T15:44:43.513Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-26T15:16:42.830

Modified: 2026-08-31T22:56:36.390

Link: CVE-2026-13480

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T19:30:05Z

Weaknesses