CVE-2026-13479 zephyrproject CVE debrief

Who should care

Users of the ZephyrProject Zephyr operating system, specifically those using versions between 3.3.0 and 4.4.2, should review and apply the patch for CVE-2026-13479 to prevent potential minor integrity impacts on the device's time estimate. Affected operators, platforms, and security teams should prioritize patching and monitor for potential issues with the device's time estimate. Compensating controls, such as monitoring and asset inventory, may be necessary for exposed systems while remediation is scheduled and verified. Rollback/change windows and source tracking may also be necessary to ensure the patch is applied correctly and to track exceptions. The patch should be applied through normal change control where exposure is confirmed. The impact of the vulnerability is minor and confined to the victim's time estimate, with no disclosure to the attacker and no crash. The fix adds an explicit length check that drops a too-short AppTimeAns. The backing store is a fixed 255-byte static buffer, so the few stray bytes do not fault, and the read values (time_correction, token) are used only internally and never transmitted. The practical attacker is a malicious or compromised network/application server (the designated sender of AppTimeAns) or a party holding the session keys, rather than an arbitrary radio listener. The vulnerability is caused by a lack of length checking in the clock_sync_package_callback() function, leading to a potential over-read of up to 5 bytes past the end of the decrypted payload. The impact is minor and confined to the victim's time estimate, with no disclosure to the attacker and no crash. The fix adds an explicit length check that drops a too-short AppTimeAns. The backing store is a fixed 255-byte static buffer, so the few stray bytes do not fault, and the read values (time_correction, token) are used only internally and never transmitted. The practical attacker is a malicious or compromised network/application server (the designated sender of AppTimeAns) or a party holding the session keys, rather than an arbitrary radio listener. The fix adds an explicit length check that drops a too-short AppTimeAns. The backing store is a fixed 255-by,

Technical summary

The LoRaWAN application-layer clock-synchronization service has a vulnerability in the clock_sync_package_callback() function, which can lead to a minor integrity impact on the device's time estimate. The vulnerability is caused by a lack of length checking, leading to a potential over-read of up to 5 bytes past the end of the decrypted payload. The practical attacker is a malicious or compromised network/application server (the designated sender of AppTimeAns) or a party holding the session keys, rather than an arbitrary radio listener. The fix adds an explicit length check that drops a too-short AppTimeAns.

Defensive priority

Review and apply the patch for CVE-2026-13479 to prevent potential minor integrity impacts on the device's time estimate.

Recommended defensive actions

• Review and apply the patch for CVE-2026-13479
• Verify the patch has been applied to the affected systems
• Monitor for potential issues with the device's time estimate
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability is caused by a lack of length checking in the clock_sync_package_callback() function, leading to a potential over-read of up to 5 bytes past the end of the decrypted payload. The impact is minor and confined to the victim's time estimate, with no disclosure to the attacker and no crash. Affected product deployments should be reviewed for exposure, and defenders should verify patch application and monitor for potential issues with the device's time estimate. The fix adds an explicit length check that drops a too-short AppTimeAns. The backing store is a fixed 255-byte static buffer, so the few stray bytes do not fault, and the read values (time_correction, token) are used only internally and never transmitted.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.