Zephyr RTOS EUVD-2026-66555

The LoRaWAN clock synchronization service (CONFIG_LORAWAN_APP_CLOCK_SYNC or equivalent) must be compiled and active on the target Zephyr device. The attacker must be able to deliver a LoRaWAN downlink that passes the stack's MAC integrity check (MIC verification) and FRMPayload decryption - this requires either operating the legitimate LoRaWAN network or application server for the device, or independently possessing the current NwkSKey and AppSKey session keys. Arbitrary LoRaWAN radio observers cannot forge valid frames without these keys. Limiting factors: attacker position is highly constrained (server control or key possession required); impact is bounded to device-local clock offset corruption; no user interaction or privilege escalation path exists.

The provided CVSS 3.1 base score of 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the constrained real-world risk. Adjacent attack vector is correct because exploitation requires delivering a valid LoRaWAN downlink that survives MAC integrity verification and FRMPayload decryption - an arbitrary radio listener cannot forge such a frame. High attack complexity is appropriate because the attacker must either operate the legitimate LoRaWAN application server for the targeted device or independently possess the current session keys. The sole impact is a transient, device-local time-offset corruption (I:L), with no confidentiality or availability consequence confirmed. No EPSS score was provided in source data; given the niche attacker position (server-side control or key possession), opportunistic mass exploitation is implausible. No KEV listing and no public exploit exist. Despite the technical OOB read classification, this is a genuine low-priority item: the bounded buffer prevents crashes, the over-read values are never exfiltrated, and the practical attacker already occupies a highly privileged network position. The sibling unguarded one-byte reads noted in the periodicity and force-resync handlers carry equivalent negligible impact.

An attacker who operates or has compromised the LoRaWAN application server for a target Zephyr device crafts a short AppTimeAns downlink - omitting the required 5-byte payload - and transmits it on the clock-sync port. The frame passes MAC integrity verification using the current session keys, is decrypted, and delivered to clock_sync_package_callback(); the handler then reads 5 bytes past the valid payload into adjacent static buffer memory, potentially applying a garbage time-correction to the device's ctx.time_offset. No public exploit code exists; exploitation requires server-side access or session key compromise.