CVE-2023-4041: Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-23 · updated 2026-06-17
Weakness: CWE-120

Description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader.

Affected products

silabs.com Gecko Bootloader: before 4.2.4; from 4.3.0 before 4.3.2 — fixed in 4.2.4, 4.3.2

How to fix

Upgrade to a fixed version: silabs.com Gecko Bootloader 4.2.4, 4.3.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-4041 or the next vulnerability affects your stack