Buffer Overflow Vulnerability in LoRaWAN TS004 Handler by Zephyr Project

CVE-2026-13480

What is CVE-2026-13480?

A vulnerability exists in the LoRaWAN TS004 Fragmented Data Block Transport handler's frag_transport_package_callback() function, where it improperly parses downlink command bytes. Without validating the remaining payload length, the function can lead to buffer overflow scenarios. The vulnerability allows attackers, who have obtained device session keys, to exploit this flaw by sending maliciously crafted downlink data. This may enable them to read beyond the allocated memory limits, potentially exposing sensitive data. The issue is mitigated in patches which implement necessary checks to ensure that memory accesses remain within the appropriate bounds.

References