Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-13481— Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

中的 IEEE 1588 PTP 管理消息解析器在处理 管理 ID 时存在缺陷。在 函数中， 分支将 强制转换为 10 字节的 结构体并进行读取（随后进行字节序转换并写回），但在此前并未检查 TLV 数据字段的长度是否至少为 。同一 语句中的其他兄弟管理 ID 分支都会先验证长度；而 是唯一缺少该检查的分支。 传入的长度参数是管理数据的大小（即 ），上游在 中的守卫条件仅要求 ，而 仅验证 TLV 是否落在已接收字节数范围内，并未针对特定 ID 设置最小长度要求。因此，本地 PTP 网段上的对端可以发送一条携带短小

CVSS 5.4 · Medium

Possible ATT&CK Techniques 1 AI

T1210 · Exploitation of Remote Services

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 3.7.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-13481

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP
Source: CVE Program / CVE List V5
Vulnerability Description
The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(), the PTP_MGMT_TIME case casts mgmt_tlv->data to a 10-byte struct ptp_timestamp and reads it (then byte-swaps and writes it back) without first checking that the TLV data field is at least sizeof(struct ptp_timestamp). Every sibling management id in the same switch validates its length first; PTP_MGMT_TIME was the only case lacking that check. The length passed in is the management data size (tlv->length - 2), and the upstream guard in ptp_tlv_post_recv() only requires tlv->length > 2, while msg_tlv_post_recv() validates only that the TLV fits within the received byte count, not a per-id minimum. A peer on the local PTP segment can therefore send a PTP_MSG_MANAGEMENT message carrying a short PTP_MGMT_TIME TLV (data as small as 2 bytes), causing the parser to read and write 8 bytes beyond the validated data. The message type and TLV contents are taken straight off the wire, so the path is reachable by any adjacent attacker when CONFIG_PTP is enabled. The over-read and write-back stay within the struct ptp_msg allocation (mgmt_tlv->data lives in the leading mtu[NET_ETH_MTU] union member, so data + 10 lands at most a few bytes past mtu[], inside the same object), so this is an out-of-bounds read of adjacent in-object memory plus a bounded in-place corruption of the message's parsed timestamp, not past-allocation memory corruption. Impact is limited to minor information exposure of adjacent bytes and corruption of the device's parsed management TIME value; there is no crash on the access and no reachable reference-count corruption. The fix adds if (length < sizeof(struct ptp_timestamp)) { return -EBADMSG; } before the cast, matching the other management-id cases and fully closing the receive-path defect.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 3.7.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-13481

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-13481

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-13481 (1)

Vendor Advisories for CVE-2026-13481 (1)

Same Patch Batch · zephyrproject · 2026-08-26 · 3 CVEs total

CVE-2026-13480 3.1 LOW Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler
CVE-2026-13479 3.1 LOW Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-125

V. Comments for CVE-2026-13481

No comments yet

Leave a comment