CVE-2026-13479

Analyzed Analyzed - Analysis Complete

Buffer Over-Read in LoRaWAN Clock Sync Service

Publication date: 2026-08-26

Last updated on: 2026-08-31

Assigner: Zephyr Project

Description

The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command the handler then reads a 4-byte time correction via sys_get_le32() plus a 1-byte token without checking that 5 bytes remain in the receive buffer (len - rx_pos). A short or crafted AppTimeAns therefore reads up to 5 bytes past the end of the decrypted payload. The payload (rx_buf/len) is the decrypted application frame delivered to the registered downlink callback (mcps_indication->Buffer/BufferSize). Reaching the handler requires a frame on the clock-sync port that passes LoRaWAN's MAC integrity check and FRMPayload decryption, so the practical attacker is a malicious or compromised network/application server (the designated sender of AppTimeAns) or a party holding the session keys, rather than an arbitrary radio listener. The over-read is bounded: the backing store is a fixed 255-byte static buffer, so the few stray bytes do not fault, and the read values (time_correction, token) are used only internally and never transmitted, so there is no disclosure to the attacker and no crash. The sole effect is that a stale token matching ctx.req_token can apply a garbage time_correction to the device's own clock offset (ctx.time_offset), a minor integrity impact confined to the victim's time estimate. The fix adds an explicit length check that drops a too-short AppTimeAns. Note the sibling one-byte reads in the periodicity and force-resync handlers remain unguarded with the same negligible impact.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-31

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-13479

EUVD

EUVD-2026-66555

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	From 3.3.0 (inc) to 4.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a low-severity out-of-bounds read vulnerability in the LoRaWAN clock-synchronization service of Zephyr RTOS. It occurs in the clock_sync_package_callback() function where the handler for the AppTimeAns command reads 5 bytes (4-byte time correction and 1-byte token) from the receive buffer without checking if enough data remains. This allows reading up to 5 bytes past the end of the decrypted payload if the input is short or maliciously crafted.

Detection Guidance

Detecting this vulnerability requires checking for Zephyr RTOS versions affected by CVE-2026-13479. Use commands like 'git log --oneline --grep="clock_sync"' or 'grep -r "clock_sync_package_callback" subsys/lorawan/' in your Zephyr project directory. Verify if the system uses LoRaWAN clock-sync service on the vulnerable port.

Impact Analysis

The impact is limited. The over-read is bounded by a fixed 255-byte buffer, so no crashes or data disclosure occur. However, it may apply a garbage time correction to the device's clock offset if a stale token matches, causing a minor integrity impact on the device's time estimate.

Compliance Impact

This vulnerability has minimal impact on compliance with standards like GDPR or HIPAA. The out-of-bounds read is confined to a static 255-byte buffer, does not expose sensitive data, and does not cause crashes or unauthorized access. The only effect is a potential minor integrity issue with device clock synchronization, which does not violate data protection or privacy requirements under these regulations.

Mitigation Strategies

Upgrade Zephyr RTOS to version 4.4.2 or later. Apply the patch from commit 3d578067652b12993bca13fb8e07dc45d062d4a5. Ensure LoRaWAN clock-sync service inputs are validated and discard malformed AppTimeAns frames.

Hi! I’m here to help you understand CVE-2026-13479. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70