A stack-based buffer overflow vulnerability was found in oFono's AT modem Icera network time notification handler. The function tlts_notify() in drivers/atmodem/network-registration.c uses sscanf with an unbounded %s format specifier to parse a timezone string from the *TLTS: unsolicited AT notification into a 4-byte stack buffer tz[4]. The buffer is sized for a normal timezone offset like "+08" (3 chars + null = 4 bytes), but sscanf with %s reads all non-whitespace characters without any width limit.

A compromised Icera modem baseband can send a *TLTS: notification with an arbitrarily long timezone string (e.g., "24/01/15,12:30:45+BBBB...100chars..."), causing sscanf to write up to ~98 bytes past the end of the 4-byte tz buffer. This corrupts the stack frame including saved registers and the return address, leading to a crash or potentially arbitrary code execution. No user interaction is required — *TLTS: is an unsolicited notification that the modem can send at any time after registration. Since ofonod runs as root with no sandbox, successful exploitation grants root-level code execution.

This vulnerability is similar to ZDI-CAN-30191 (huawei_nwtime_notify) but affects the Icera *TLTS: handler instead of the Huawei ^NWTIME: handler.

The vulnerability was tested on oFono version 2.19 on Ubuntu 25.04.