CVE-2026-13480: bounds in zephyrproject zephyr

The vulnerability exists in the frag_transport_package_callback() function within the LoRaWAN fragmented transport service of Zephyr. The handler parses downlink commands without verifying that sufficient payload bytes remain before accessing a 10-byte structure or reading fragment data. An attacker controlling the fragment size (via a prior FRAG_SESSION_SETUP command) can cause the decoder to read beyond the allocated RxPayload buffer by padding the payload with filler commands and a crafted fragment. This out-of-bounds read leaks adjacent static memory into decoder buffers and the FUOTA flash image. The flaw is exploitable only by an entity with the device's session keys, as the handler processes only authenticated and decrypted downlinks. No direct data disclosure to the attacker occurs, and the over-read is unlikely to cause crashes on typical MCU memory layouts. The vulnerability does not allow writes or control-flow manipulation. The fix involves adding checks to ensure sufficient remaining payload length before each access.

The vulnerability allows a bounded out-of-bounds read of static memory within the device, potentially leaking adjacent memory contents into internal buffers. However, since the attacker must have the device's session keys to send valid downlinks, and no data is returned to the attacker directly, the confidentiality impact is limited. There is no impact on integrity or availability beyond a low likelihood of a crash. Overall, the impact is low.

No official patch or remediation level is stated in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix reportedly adds remaining-length checks before each access to prevent out-of-bounds reads. Until a patch is applied, ensure that only trusted entities with session keys can send downlink commands to the device.