CVE-2026-6432: Improper bounds validation in EmberZNet SDK

Severity: medium (CVSS 5.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-25 · updated 2026-10-25
Weakness: CWE-130

Description

Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage. In order to exploit this vulnerability, an attacker would have to have the ability to send arbitrary messages on the network. The only known exploit of this vulnerability leaks a limited number of bytes from the stack. No denial-of-service, memory corruption, or remote code execution has been shown.

Affected products

Silicon Labs EmberZNet: from 8.0.0 through 9.1.1; through 7.5.1

References

https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000580.md

Get alerted when CVE-2026-6432 or the next vulnerability affects your stack