Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-13479
zephyrproject zephyr — Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler
AV AC PR UI S C I A CVSS EPSS %ile KEV
A L N N U N L N 4.3 .0024 13.2 —
AFFECTED
Product Versions Fixed
zephyr 3.3.0 – —
TIMELINE
Jun 27 Reserved by zephyr
Aug 26 Published (CNA: zephyr)
Aug 31 EXPLOIT PUBLISHED — CVE-2026-13479 (zephyrproject zephyr). Public exploit reference added.
Aug 31 RESCORED — CVE-2026-13479 (zephyrproject zephyr). CVSS 3.1 → 4.3 (NVD).
Description
The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_callback() (subsys/lorawan/services/clock_sync.c). Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCK_SYNC_CMD_APP_TIME (AppTimeAns) command the handler then reads a 4-byte time correction via sys_get_le32() plus a 1-byte token without checking that 5 bytes remain in the receive buffer (len - rx_pos). A short or crafted AppTimeAns therefore reads up to 5 bytes past the end of the decrypted payload.
The payload (rx_buf/len) is the decrypted application frame delivered to the registered downlink callback (mcps_indication->Buffer/BufferSize). Reaching the handler requires a frame on the clock-sync port that passes LoRaWAN's MAC integrity check and FRMPayload decryption, so the practical attacker is a malicious or compromised network/application server (the designated sender of AppTimeAns) or a party holding the session keys, rather than an arbitrary radio listener.
The over-read is bounded: the backing store is a fixed 255-byte static buffer, so the few stray bytes do not fault, and the read values (time_correction, token) are used only internally and never transmitted, so there is no disclosure to the attacker and no crash. The sole effect is that a stale token matching ctx.req_token can apply a garbage time_correction to the device's own clock offset (ctx.time_offset), a minor integrity impact confined to the victim's time estimate. The fix adds an explicit length check that drops a too-short AppTimeAns. Note the sibling one-byte reads in the periodicity and force-resync handlers remain unguarded with the same negligible impact.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| June 27, 2026 | Reserved | Reserved by zephyr |
| August 26, 2026 | Published | Published (CNA: zephyr) |
| August 31, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-13479 (zephyrproject zephyr). Public exploit reference added. |
| August 31, 2026 | RESCORED | RESCORED — CVE-2026-13479 (zephyrproject zephyr). CVSS 3.1 → 4.3 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| zephyrproject | zephyr | — | 3.3.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-13479 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
