CVE-2022-39274

CVE-2022-39274 describes a critical buffer overflow vulnerability in LoRaMac-node versions prior to 4.7.0, a reference implementation for LoRa network nodes. This flaw, caused by improper size validation of incoming radio frames, allows an attacker to trigger a 65280-byte out-of-bounds write or a 1-byte out-of-bounds read. With a CVSS score of 9.8 (CRITICAL), the vulnerability can be exploited remotely without authentication, potentially leading to denial of service or arbitrary code execution. While there is no evidence of active exploitation, public exploit code, or significant community discussion, affected users are strongly advised to upgrade to version 4.7.0 or apply the specified patch.