CVE-2025-3873: Buffer overflow in Si91x crypto APIs

Severity: medium (CVSS 6.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-25 · updated 2026-06-17
Weakness: CWE-787

Description

The following APIs for the Silcon Labs SiWx91x prior to vesion 3.4.0 failed to check the size of the output buffer of the caller which could lead to data corruption on the host (Cortex-M4) application. sl_si91x_aes sl_si91x_gcm sl_si91x_ccm sl_si91x_sha

Affected products

silabs.com WiseConnect: from 3.0.0 before 3.4.0 — fixed in 3.4.0

How to fix

Upgrade to a fixed version: silabs.com WiseConnect 3.4.0. Check the vendor advisory for mitigations.

References

https://community.silabs.com/068Vm00000SSlOu
https://docs.silabs.com/wiseconnect/latest/sisdk-wifi-release-notes/

Get alerted when CVE-2025-3873 or the next vulnerability affects your stack