CVE-2026-13479: LoRaWAN Clock-Sync Buffer Overflow Flaw

CVE-2026-13479 Overview

CVE-2026-13479 is an out-of-bounds read [CWE-125] in the Zephyr RTOS LoRaWAN application-layer clock-synchronization service. The vulnerable code in subsys/lorawan/services/clock_sync.c parses downlinks inside clock_sync_package_callback(). The command loop validates only the one-byte command id and fails to confirm that five additional bytes remain in the receive buffer before handling CLOCK_SYNC_CMD_APP_TIME (AppTimeAns). A short or crafted AppTimeAns therefore reads up to five bytes past the decrypted payload.

Critical Impact
A malicious or compromised LoRaWAN network or application server holding valid session keys can inject a garbage time correction into the device's ctx.time_offset, producing a minor integrity impact on the victim's local time estimate.

Affected Products

Zephyr RTOS LoRaWAN subsystem
subsys/lorawan/services/clock_sync.c clock-synchronization service
Devices exposing the LoRaWAN clock-sync port to downlinks

Discovery Timeline

2026-08-26 - CVE-2026-13479 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-13479

Vulnerability Analysis

The defect lives in the command dispatcher for LoRaWAN application-layer clock synchronization. When the handler processes the CLOCK_SYNC_CMD_APP_TIME command, it reads a 4-byte little-endian time correction via sys_get_le32() followed by a 1-byte token. The loop enforces bounds only on the one-byte command id, so the handler proceeds without confirming that len - rx_pos is at least five bytes.

The payload arrives as rx_buf and len, sourced from mcps_indication->Buffer and mcps_indication->BufferSize. That data has already passed the LoRaWAN MAC integrity check and FRMPayload decryption. Only an entity holding the session keys, typically the network or application server designated to send AppTimeAns, can reach this code path. Arbitrary radio listeners cannot trigger the flaw.

Root Cause

The root cause is missing input validation on the AppTimeAns sub-command length. The command loop treats presence of a valid command id as sufficient and delegates no length responsibility to individual handlers. Sibling handlers for the periodicity and force-resync commands share the same pattern for their one-byte reads.

Attack Vector

The read overflow is bounded by a fixed 255-byte static backing buffer, so the extra bytes never fault. The values read into time_correction and the token remain local and are never transmitted, so no memory contents leak to the attacker. The only observable effect is that a stale token matching ctx.req_token allows a garbage time_correction to update ctx.time_offset, skewing the device's clock estimate.

			/* answer from application server */
			int32_t time_correction;

+			/* AppTimeAns carries a 4-byte time correction plus a
+			 * 1-byte token; make sure they are present before reading.
+			 */
+			if ((len - rx_pos) < (sizeof(int32_t) + sizeof(uint8_t))) {
+				LOG_ERR("AppTimeAns too short");
+				return;
+			}
+
			ctx.nb_transmissions = 0;

			time_correction = (int32_t)sys_get_le32(&rx_buf[rx_pos]);

Source: Zephyr commit 3d578067

Detection Methods for CVE-2026-13479

Indicators of Compromise

AppTimeAns downlinks on the clock-sync port that are shorter than five bytes after the command id.
Unexpected drift in device-reported clock offset (ctx.time_offset) following a downlink from the application server.
Log entries showing acceptance of AppTimeAns frames on unpatched firmware where the fix would emit AppTimeAns too short.

Detection Strategies

Inspect application server logs for malformed or truncated AppTimeAns frames sent to end devices.
Compare firmware builds against the fixed commit to identify devices still running the unguarded handler.
Correlate time-sync anomalies with the identity of the transmitting network or application server.

Monitoring Recommendations

Monitor for unauthorized access to LoRaWAN session keys and application server credentials.
Track downlink frame sizes on the clock-sync port and alert on frames below the expected AppTimeAns length.
Audit any change in device clock offsets that is not tied to a legitimate operational sync event.

How to Mitigate CVE-2026-13479

Immediate Actions Required

Update Zephyr-based firmware to include the fix from commit 3d578067652b12993bca13fb8e07dc45d062d4a5.
Rotate LoRaWAN session keys on any device that shares keys with a suspected compromised server.
Restrict which application servers are authorized to send AppTimeAns to production fleets.

Patch Information

The fix adds an explicit length check in clock_sync_package_callback() that drops any AppTimeAns shorter than five bytes. Details are available in the Zephyr GHSA-2m6g-p3vx-p2fh advisory and the upstream commit.

Workarounds

Disable the LoRaWAN clock-sync service on devices that do not require application-layer time synchronization.
Enforce strict access controls and mutual authentication between end devices and application servers.
Validate downlink frame sizes at the application server before transmission to reduce exposure from misconfigured senders.

bash

# Rebuild Zephyr with the patched clock_sync service
cd zephyr
git fetch origin
git cherry-pick 3d578067652b12993bca13fb8e07dc45d062d4a5
west build -b <board> samples/subsys/lorawan/class_a