The LoRaWAN Fragmented Data Block Transport service in Zephyr does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the decoder. Specifically, a frag_counter value of zero causes an underflow in array indexing, leading to an out-of-bounds write of a uint16_t zero into the adjacent recovery matrix state of the decoder object. This vulnerability requires authenticated downlink access and an active fragmentation session. The impact is limited to corruption of decoder state and denial of the firmware update session (FUOTA), without controllable memory corruption or code execution. The fix adds a transport-layer check rejecting frag_counter == 0, mitigating the issue for both decoder backends.

An attacker with authenticated downlink access to an active fragmentation session can trigger out-of-bounds writes in the decoder state, causing corruption and denial of the firmware update session. There is no impact on confidentiality or integrity beyond denial of service, and no known exploit for arbitrary code execution. The vulnerability affects availability of the FUOTA process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has implemented a fix that adds a transport-layer check rejecting frag_counter values of zero, closing the defect for both decoder backends. Until the fix is applied, ensure that only trusted and authenticated downlink sources can send fragmentation commands.