CVE-2026-13480

Name of the Vulnerable Software and Affected Versions loramac-node (affected versions not specified)

Description The LoRaWAN TS004 Fragmented Data Block Transport handler frag transport package callback() in subsys/lorawan/services/frag transport.c parses downlink command bytes without validating if sufficient payload bytes remain before each access. The handler casts rx buf + rx pos to a 10-byte frag transport setup req struct or passes &rx buf[rx pos] to the fragment decoder, which reads ctx.frag size bytes without checking the remaining length. Since ctx.frag size is attacker-controlled via a FRAG SESSION SETUP command, an attacker possessing the device session keys can use mismatched-index DATA FRAGMENT filler commands to force the decoder to read beyond the end of the MacCtx.RxPayload buffer. This results in a bounded out-of-bounds read, potentially copying adjacent static memory into decoder buffers and the FUOTA (Firmware Update Over-The-Air) flash image. The issue is limited to parties with session keys, and because the over-read data is not returned to the sender, there is no direct disclosure channel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.