CVE-2026-13481

CVE-2026-13481 is an out-of-bounds read (CWE-125) in the IEEE 1588 PTP management-message parser of the Zephyr RTOS networking stack (subsys/net/lib/ptp/tlv.c), where the PTP_MGMT_TIME management id is cast to a 10-byte struct ptp_timestamp and read without first checking that the TLV data field is at least that long — the only management id in the switch missing this validation. An adjacent attacker on the local PTP segment can send a management message carrying a short PTP_MGMT_TIME TLV (data as small as 2 bytes), causing the parser to read and then byte-swap and write back 8 bytes beyond the validated data; the path is reachable whenever CONFIG_PTP is enabled. The attacker gains minor information exposure of adjacent bytes within the same message object and can corrupt the device's parsed management TIME value; there is no crash, no past-allocation memory corruption, and no reachable reference-count corruption. Only Zephyr builds with the PTP subsystem enabled are affected — a profile typical of industrial and telecom precision-timing deployments — and the Zephyr Project (the CNA) has published advisory GHSA-mh5r-jxh8-hxwx alongside the fix. Exploitation status: one public advisory/PoC reference exists, but there is no evidence of in-the-wild exploitation (EPSS 0.2%, not in CISA KEV).

What to do: Upgrade to a Zephyr release that includes the upstream fix, which adds the missing guard — returning -EBADMSG when the TLV data is shorter than sizeof(struct ptp_timestamp) — in tlv_mgmt_post_recv(), and consult GHSA-mh5r-jxh8-hxwx for the exact fixed version for your branch. If patching is not immediately possible, disable CONFIG_PTP or restrict acceptance of PTP management messages to trusted adjacent peers. Given the low EPSS and absence of known in-the-wild exploitation this is not urgent, but exposed precision-timing deployments should prioritize the update.