CVE-2026-13479

Zephyr RTOS LoRaWAN clock-synchronization service (subsys/lorawan/services/clock_sync.c) contains an out-of-bounds read in clock_sync_package_callback(). When processing the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) downlink, the handler reads a 4-byte time correction and a 1-byte token without verify...