CVE-2026-13481

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. In tlv_mgmt_post_recv(), the PTP_MGMT_TIME case casts mgmt_tlv->data to a 10-byte struct ptp_timestamp and reads it (then byte-swaps and writes it back) without first checking that the TLV data field is at least sizeof(struct ptp_timestamp). Every sibling management id in the same switch validates its length first; PTP_MGMT_TIME was the only case lacking that check. The length passed in is the management data size (tlv->length - 2), and the upstream guard in ptp_tlv_post_recv() only requires tlv->length > 2, while msg_tlv_post_recv() validates only that the TLV fits within the received byte count, not a per-id minimum. A peer on the local PTP segment can therefore send a PTP_MSG_MANAGEMENT message carrying a short PTP_MGMT_TIME TLV (data as small as 2 bytes), causing the parser to read and write 8 bytes beyond the validated data. The message type and TLV contents are taken straight off the wire, so the path is reachable by any adjacent attacker when CONFIG_PTP is enabled. The over-read and write-back stay within the struct ptp_msg allocation (mgmt_tlv->data lives in the leading mtu[NET_ETH_MTU] union member, so data + 10 lands at most a few bytes past mtu[], inside the same object), so this is an out-of-bounds read of adjacent in-object memory plus a bounded in-place corruption of the message's parsed timestamp, not past-allocation memory corruption. Impact is limited to minor information exposure of adjacent bytes and corruption of the device's parsed management TIME value; there is no crash on the access and no reachable reference-count corruption. The fix adds if (length < sizeof(struct ptp_timestamp)) { return -EBADMSG; } before the cast, matching the other management-id cases and fully closing the receive-path defect.

• CWE-125

• https://github.com/zephyrproject-rtos/zephyr/commit/de98c3721a0e21ca269313997736f4f6193909efPatch
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mh5r-jxh8-hxwxExploit, Patch, Vendor Advisory

Published

Aug 26, 2026

Last Modified

Aug 31, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13474Denial of service via malformed HTTP/2 requests in NetScaler…7.5
• CVE-2026-13476IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could all…7.3
• CVE-2026-13477IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 …8.8
• CVE-2026-13478The Zephyr ext2 filesystem driver validates the on-disk bloc…5.5
• CVE-2026-13479The LoRaWAN application-layer clock-synchronization service …4.3
• CVE-2026-13480The LoRaWAN TS004 Fragmented Data Block Transport handler fr…3.1
• CVE-2026-13482A vulnerability was detected in skypilot-org skypilot up to …3.7
• CVE-2026-13483A flaw has been found in arc53 DocsGPT up to 0.18.0. The aff…3.1
• CVE-2026-13484A vulnerability has been found in MLflow up to 4666cffc7912e…8.8
• CVE-2026-13485A vulnerability was found in SourceCodester Class and Exam T…7.3
• CVE-2026-13486A vulnerability was determined in SourceCodester Class and E…7.3
• CVE-2026-13487A vulnerability was identified in SourceCodester Class and E…7.3