CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler

The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...

CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler

The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...

CVE-2026-13480

CVE-2026-13480 is an out-of-bounds read in the Zephyr RTOS LoRaWAN TS004 Fragmented Data Block Transport (FUOTA) downlink handler (frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c). The handler fails to validate remaining payload length before casting to a 10-byte set...

PT-2026-82106

Name of the Vulnerable Software and Affected Versions loramac-node affected versions not specified Description The LoRaWAN TS004 Fragmented Data Block Transport handler frag transport package callback in subsys/lorawan/services/frag transport.c parses downlink command bytes without validating if...

CVE-2026-12363

The LoRaWAN Fragmented Data Block Transport service subsys/lorawan/services/fragtransport.c does not validate the fragment counter in a received DATAFRAGMENT command before forwarding it to the configured decoder. In fragtransportpackagecallback the value fragcounter = hdr-fragindexn & 0x3FFF is...

CVE-2026-12363 Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0

The LoRaWAN Fragmented Data Block Transport service subsys/lorawan/services/fragtransport.c does not validate the fragment counter in a received DATAFRAGMENT command before forwarding it to the configured decoder. In fragtransportpackagecallback the value fragcounter = hdr-fragindexn & 0x3FFF is...

CVE-2026-12363

CVE-2026-12363 : The LoRaWAN Fragmented Data Block Transport service does not validate frag_counter in DATA_FRAGMENT before passing it to the decoder. frag_counter is derived from the payload (frag_index_n & 0x3FFF) and, when 0, causes fragCounter − 1 to underflow, writing out of bounds in the de...

CVE-2026-12363

The LoRaWAN Fragmented Data Block Transport service subsys/lorawan/services/fragtransport.c does not validate the fragment counter in a received DATAFRAGMENT command before forwarding it to the configured decoder. In fragtransportpackagecallback the value fragcounter = hdr-fragindexn & 0x3FFF is...

EUVD-2026-58749

The LoRaWAN Fragmented Data Block Transport service subsys/lorawan/services/fragtransport.c does not validate the fragment counter in a received DATAFRAGMENT command before forwarding it to the configured decoder. In fragtransportpackagecallback the value fragcounter = hdr-fragindexn & 0x3FFF is...

CVE-2026-12363 Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0

The LoRaWAN Fragmented Data Block Transport service subsys/lorawan/services/fragtransport.c does not validate the fragment counter in a received DATAFRAGMENT command before forwarding it to the configured decoder. In fragtransportpackagecallback the value fragcounter = hdr-fragindexn & 0x3FFF is...

PT-2026-72075

Name of the Vulnerable Software and Affected Versions LoRaWAN Fragmented Data Block Transport affected versions not specified Description The LoRaWAN Fragmented Data Block Transport service fails to validate the fragment counter in a received DATA FRAGMENT command before forwarding it to the...