Zephyr RTOS CVE-2026-13481

CONFIG_PTP must be explicitly enabled in the Zephyr build configuration - this is not a default-on option, so stock Zephyr builds without PTP are entirely unaffected. The attacker must have Layer 2 (Ethernet/link-local) adjacency to the target device on the PTP network segment; remote internet-based exploitation is not possible given AV:A. No authentication or privileges are required on the PTP message path, and no user interaction is needed. The over-read and write-back are bounded within the struct ptp_msg heap object, so exploitation cannot produce a crash or achieve past-allocation corruption - this limits the vulnerability to in-object adjacent-byte disclosure and timestamp value corruption. The absence of a crash primitive and the requirement for same-segment adjacency together significantly limit the realistic threat beyond insider or compromised-peer scenarios.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 5.4) accurately captures the threat model: exploitation requires Layer 2 adjacency on the PTP segment and carries only limited confidentiality and integrity impact. There is no availability degradation because the over-read does not cause a crash and the write-back stays within the same object. The bounded, in-object nature of the corruption (reading adjacent struct bytes rather than arbitrary heap memory) is a significant real-world risk reducer compared to a typical heap out-of-bounds write. The attack surface is further restricted by CONFIG_PTP being a non-default build-time option - devices that do not implement PTP are wholly unaffected. No EPSS score was supplied; given the narrow attack surface (same L2 segment, PTP-enabled embedded device, no crash primitive), exploitation probability is expected to be very low. The vulnerability is not listed in CISA KEV, and no POC has been identified, making opportunistic mass exploitation implausible. For defenders: the realistic priority is patching edge-case IoT or industrial control devices that run Zephyr with PTP enabled on untrusted network segments.

An attacker on the same Ethernet or Layer 2 network segment as a Zephyr device with CONFIG_PTP enabled crafts a PTP_MSG_MANAGEMENT frame carrying a PTP_MGMT_TIME TLV with only 2 bytes of data (the minimum that passes the upstream guard) and sends it to the device. The parser casts the 2-byte buffer to a 10-byte struct ptp_timestamp, reads 8 bytes of adjacent in-object memory (potentially exposing bytes from neighboring struct fields), and writes the byte-swapped result back, silently corrupting the device's parsed management timestamp. No public exploit code has been identified at time of analysis.