Memory Handling Flaw in PTP Management-Messages in Zephyr RTOS

CVE-2026-13481

What is CVE-2026-13481?

A flaw exists in the IEEE 1588 Precision Time Protocol (PTP) management-message parser within Zephyr RTOS. The issue arises when handling the PTP_MGMT_TIME management ID in the function tlv_mgmt_post_recv(). The parser does not verify the length of the TLV data before casting it to a 10-byte structure, which can allow an adjacent attacker to exploit this oversight. By sending a PTP_MSG_MANAGEMENT message with an undersized PTP_MGMT_TIME TLV, the parser can read and write beyond the validated data boundaries. Although the impact is limited to potential exposure of adjacent in-object memory information and corruption of the parsed timestamp, it poses a risk in systems where CONFIG_PTP is enabled. The implemented fix ensures proper length validation to rectify this vulnerability.

References