CVE-2026-12363

Name of the Vulnerable Software and Affected Versions LoRaWAN Fragmented Data Block Transport (affected versions not specified)

Description The LoRaWAN Fragmented Data Block Transport service fails to validate the fragment counter in a received DATA FRAGMENT command before forwarding it to the configured decoder. In the frag transport package callback() function, the frag counter value is taken directly from the downlink payload. Because DataFragment fragments are 1-indexed, a frag counter of 0 causes an arithmetic underflow when the decoder calculates the array index and flash offset as frag counter - 1.

When using the default Semtech/LoRaMAC-node decoder, this leads to an out-of-bounds write in the FragDecoderProcess() function, specifically at FragDecoder.FragNbMissingIndex[fragCounter - 1] = 0, where the index evaluates to -1. This corrupts the adjacent MatrixM2B recovery-matrix state of the static decoder object. This issue is reachable via authenticated downlinks during an active fragmentation session, such as through a compromised network or FUOTA server. The impact is limited to the corruption of the decoder state and the denial of the firmware-update (FUOTA) session.

Recommendations As a temporary mitigation, restrict the use of the frag transport package callback() function or ensure that the network server does not send DATA FRAGMENT commands with a frag counter of 0 until a patch is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.