EUVD-2026-58749Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Adjacent network (LoRaWAN protocol); high complexity due to active-session prerequisite and server-control requirement; impact limited to FUOTA session integrity and availability.
Primary rating from Vendor (zephyrproject).
CVSS VectorVendor: zephyrproject
Lifecycle Timeline
3DescriptionCVE.org
The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the configured decoder. In frag_transport_package_callback() the value frag_counter = hdr->frag_index_n & 0x3FFF is taken directly from the downlink payload and passed to the decoder, which derives an array index and flash offset as frag_counter - 1. DataFragment fragments are 1-indexed, so a frag_counter of 0 underflows that arithmetic.
With the default Semtech/LoRaMAC-node decoder, this reaches FragDecoder.FragNbMissingIndex[fragCounter - 1] = 0; in FragDecoderProcess(), where fragCounter - 1 evaluates to -1 and writes a uint16_t zero out of bounds, just before the array and into the adjacent MatrixM2B recovery-matrix state of the static decoder object (CWE-787). A companion write derives a wild flash offset, but that path is rejected by the flash_area_write() bounds check. The in-tree low-memory decoder (frag_dec()) is not corrupted: its out-of-range bit-array and flash accesses are caught by sys_bitarray_ and flash_area_ bounds checks.
The handler is the registered downlink callback for the fragmentation transport port, reachable whenever an active fragmentation session exists, so the triggering byte is attacker-influenceable LoRaWAN/FUOTA network input. Triggering it requires authenticated downlinks (LoRaWAN MAC session keys or a malicious/compromised network or FUOTA server) and an active fragmentation session. The impact is contained: corruption of decoder state and denial of the firmware-update (FUOTA) session rather than controllable memory corruption or code execution. The fix adds a transport-layer check that rejects frag_counter == 0, closing the defect for both decoder backends.
AnalysisAI
Out-of-bounds write in Zephyr RTOS's LoRaWAN Fragmented Data Block Transport service corrupts the Semtech/LoRaMAC-node decoder's internal MatrixM2B recovery-matrix state when a DATA_FRAGMENT command carries frag_index_n = 0, underflowing the 1-indexed counter arithmetic to array index -1. Impact is constrained to denial of an active FUOTA (Firmware Update Over The Air) session and decoder state corruption - not code execution - despite 'RCE' appearing in the intelligence metadata tags, which directly contradicts the CVE description. No public exploit has been identified and this vulnerability is not listed in CISA KEV.
Technical ContextAI
Zephyr RTOS implements the LoRa Alliance Fragmented Data Block Transport specification in subsys/lorawan/services/frag_transport.c. The frag_transport_package_callback() function extracts a 14-bit fragment counter from the LoRaWAN downlink payload via frag_counter = hdr->frag_index_n & 0x3FFF and passes it directly to the configured decoder without a lower-bound check. DataFragment counters are 1-indexed per specification, so a value of 0 is invalid. With the default Semtech/LoRaMAC-node decoder backend, FragDecoderProcess() computes fragCounter - 1 as an array subscript into FragNbMissingIndex[]; a counter of 0 evaluates to index -1, writing a zeroed uint16_t one slot before the array boundary into the adjacent MatrixM2B recovery-matrix field of the static decoder object. This is a CWE-787 (Out-of-bounds Write) defect. A companion flash-offset underflow is independently blocked by flash_area_write() bounds checking. The in-tree low-memory decoder (frag_dec()) is not affected because its out-of-range bit-array and flash accesses are caught by sys_bitarray_ and flash_area_ bounds checks respectively.
RemediationAI
Apply the upstream fix from commit 452c704a28369236e555543c61a1894cd1a4afbb in the Zephyr GitHub repository (https://github.com/zephyrproject-rtos/zephyr/commit/452c704a28369236e555543c61a1894cd1a4afbb), which inserts a transport-layer guard in frag_transport_package_callback() that discards any DATA_FRAGMENT command with frag_counter == 0 before it reaches any decoder backend. A specific patched release version is not confirmed in the available data - consult GHSA-fvm7-7whg-8gj6 for release version guidance. As a compensating control, operators can disable the LoRaWAN fragmentation transport service at compile time if FUOTA functionality is not operationally required; the trade-off is loss of over-the-air firmware update capability. Restricting FUOTA server infrastructure access to trusted, hardened hosts reduces the attacker's ability to send authenticated downlinks, but does not eliminate the vulnerability.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today