PatchTheCVECVE-2026-13480: The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/
CVE-2026-13480 is a low-severity flaw (CVSS 3.1) affecting zephyr. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rx_pos < len; after consuming the one-byte command id the handler cast rx_buf + rx_pos to a 10-byte struct frag_transport_setup_req, and for a DATA_FRAGMENT command passed &rx_buf[rx_pos]
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Last updated 2026-08-31 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-13480?
zephyr: upgrade to 4.4.2. Exact commands for each OS are on this page.
Is CVE-2026-13480 being exploited?
CVE-2026-13480 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-13480 affect?
CVE-2026-13480 affects zephyr. Severity is low (CVSS 3.1). The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. Th
How urgent is CVE-2026-13480?
Priority 19/100. Public exploit reference
Related CVEs
- CVE-2026-1677 MEDIUM 5.3 UPGRADE Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions
- CVE-2026-1681 MEDIUM 6.1 UPGRADE Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack
- CVE-2026-10638 MEDIUM 5.9 UPGRADE subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try
- CVE-2026-10637 MEDIUM 5.9 UPGRADE subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt)
- CVE-2026-10641 HIGH 7.1 UPGRADE Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_