---
id: CVE-2026-12363
title: Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0
summary: >-
  The LoRaWAN Fragmented Data Block Transport service
  (subsys/lorawan/services/frag_transport.c) does not validate the fragment
  counter in a received DATA_FRAGMENT command before forwarding it to the
  configured decoder. In frag_transport_p…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-787
vendor: zephyrproject
product: zephyr
affected:
  - zephyr >= 3.7.0 < 4.3.2
  - zephyr >= 4.4.0 < 4.5.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-14T19:26:34.004071Z'
published: '2026-08-14'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T04:59:27.939Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-12363'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/commit/452c704a28369236e555543c61a1894cd1a4afbb
    label: Fix commit
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fvm7-7whg-8gj6
    label: GHSA-fvm7-7whg-8gj6
tags:
  - cve.org
epss: 0.00244
epssPercentile: 0.15717
ingestedAt: '2026-11-05T20:33:06.701Z'
---

## Overview

The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the configured decoder. In frag_transport_package_callback() the value frag_counter = hdr->frag_index_n & 0x3FFF is taken directly from the downlink payload and passed to the decoder, which derives an array index and flash offset as frag_counter - 1. DataFragment fragments are 1-indexed, so a frag_counter of 0 underflows that arithmetic.

With the default Semtech/LoRaMAC-node decoder, this reaches FragDecoder.FragNbMissingIndex[fragCounter - 1] = 0; in FragDecoderProcess(), where fragCounter - 1 evaluates to -1 and writes a uint16_t zero out of bounds, just before the array and into the adjacent MatrixM2B recovery-matrix state of the static decoder object (CWE-787). A companion write derives a wild flash offset, but that path is rejected by the flash_area_write() bounds check. The in-tree low-memory decoder (frag_dec()) is not corrupted: its out-of-range bit-array and flash accesses are caught by sys_bitarray_ and flash_area_ bounds checks.

The handler is the registered downlink callback for the fragmentation transport port, reachable whenever an active fragmentation session exists, so the triggering byte is attacker-influenceable LoRaWAN/FUOTA network input. Triggering it requires authenticated downlinks (LoRaWAN MAC session keys or a malicious/compromised network or FUOTA server) and an active fragmentation session. The impact is contained: corruption of decoder state and denial of the firmware-update (FUOTA) session rather than controllable memory corruption or code execution. The fix adds a transport-layer check that rejects frag_counter == 0, closing the defect for both decoder backends.

## Affected

- `zephyr >= 3.7.0 < 4.3.2`
- `zephyr >= 4.4.0 < 4.5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.