CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler

The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...

PT-2026-82106

Name of the Vulnerable Software and Affected Versions loramac-node affected versions not specified Description The LoRaWAN TS004 Fragmented Data Block Transport handler frag transport package callback in subsys/lorawan/services/frag transport.c parses downlink command bytes without validating if...