CVE-2026-13480 zephyrproject CVE debrief

Who should care

Users of the Zephyr project, particularly those using LoRaWAN, should review and apply the provided patch to prevent potential out-of-bounds reads in the LoRaWAN TS004 Fragmented Data Block Transport handler. System administrators and security teams responsible for LoRaWAN deployments should also be aware of this vulnerability and take necessary precautions to secure their systems. Additionally, developers and maintainers of LoRaWAN-enabled devices and networks should verify that their implementations are not vulnerable to this issue and apply patches or mitigations as needed. Security researchers and penetration testers may also be interested in this vulnerability as it could potentially be used in targeted attacks. Finally, anyone responsible for the security of LoRaWAN-based systems should be aware of the potential risks and take steps to mitigate them. This includes reviewing system configurations, monitoring for suspicious activity, and ensuring that all necessary security measures are in place. By taking these steps, organizations can help prevent exploitation of this vulnerability and protect their systems from potential attacks. LoRaWAN device manufacturers and vendors should also be aware of this vulnerability and provide guidance and support to their customers to help them secure their systems. In addition, LoRaWAN service providers should be aware of the potential risks and take steps to mitigate them, such as implementing additional security measures and monitoring their systems for suspicious activity. Overall, a wide range of stakeholders should be aware of this vulnerability and take steps to mitigate its potential impact. This includes not only technical stakeholders such as developers and system administrators but also non-technical stakeholders such as management and leadership who are responsible for ensuring the overall security and resilience of their organization's systems and data. By working together and taking a proactive approach to security, organizations can help prevent exploitation of this vulnerability and protect their systems from potential attacks. The vulnerability has a CVSS score of 3.1 and a severity of LOW, indicating a low

Technical summary

The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The fragment size is attacker-chosen in a preceding FRAG_SESSION_SETUP command, capped at CONFIG_LORAWAN_FRAG_TRANSPORT_MAX_FRAG_SIZE, default 232. The handler runs only on downlinks that have already passed the LoRaWAN frame MIC and FRMPayload decryption, so the defect is reachable only by a party holding the device's session keys (the FUOTA server or an attacker who has compromised those keys).

Defensive priority

Review and apply the provided patch to prevent potential out-of-bounds reads in the LoRaWAN TS004 Fragmented Data Block Transport handler.

Recommended defensive actions

• Review and apply the provided patch to prevent potential out-of-bounds reads in the LoRaWAN TS004 Fragmented Data Block Transport handler.
• Verify that the device's session keys are properly secured to prevent unauthorized access.
• Monitor for any suspicious downlink commands that may be attempting to exploit this vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c does not validate that enough payload bytes remain before each access. The fragment size is attacker-chosen in a preceding FRAG_SESSION_SETUP command, capped at CONFIG_LORAWAN_FRAG_TRANSPORT_MAX_FRAG_SIZE, default 232. The handler runs only on downlinks that have already passed the LoRaWAN frame MIC and FRMPayload decryption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.