What’s Vulnerable › Vulnerabilities

CVE-2024-0240: Silicon Labs EFR32 Bluetooth stack denial of service when sending notifications to multiple clients

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-15 · updated 2026-06-17
• Weakness: CWE-401

Description

A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when sending notifications to multiple clients, this results in all Bluetooth operations, such as advertising and scanning, to stop.

Affected products

• silabs.com Gecko Platform: before 4.3.0 — fixed in 4.3.0

How to fix

Upgrade to a fixed version: silabs.com Gecko Platform 4.3.0. Check the vendor advisory for mitigations.

References

• https://community.silabs.com/069Vm000001AjEfIAK
• https://github.com/SiliconLabs/gecko_sdk
• https://community.silabs.com/069Vm000001AjEfIAK
• https://github.com/SiliconLabs/gecko_sdk

Get alerted when CVE-2024-0240 or the next vulnerability affects your stack