EUVD-2026-39411
GHSA-2mwj-cc94-39wv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with PR:L per provided vector; crashes warrant A:L and memory leakage warrants C:L, contrary to the provided VA:N omission.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
Lifecycle Timeline
1DescriptionCVE.org
Improper bounds validation in EmberZNet SDK versions 9.0.2 and earlier may result in crashes or dynamic memory leakage.
AnalysisAI
Improper bounds validation in Silicon Labs EmberZNet SDK versions 9.0.2 and earlier exposes Zigbee-connected devices to crashes and dynamic memory leakage via network-reachable input. Authenticated network attackers can trigger the flaw with low complexity, resulting in denial-of-service conditions or unintended disclosure of heap contents. No public exploit has been identified at time of analysis, and a vendor patch is available via the SISDK GitHub release repository.
Technical ContextAI
EmberZNet is Silicon Labs' embedded Zigbee protocol stack, distributed as part of the SISDK (Silicon Labs IoT SDK), identified by CPE cpe:2.3:a:silicon_labs:sisdk:*:*:*:*:*:*:*:*. The root cause is CWE-130 (Improper Handling of Length Parameter Inconsistency), a class of defect where length fields in protocol messages are not validated against actual buffer boundaries before use. In practice this means the SDK accepts crafted Zigbee frames whose embedded length parameters exceed the actual allocated buffer, causing either out-of-bounds reads that leak heap memory or memory corruption that crashes the host process. Because the Zigbee stack is typically the trust boundary for over-the-air input on IoT gateways and coordinator nodes, this flaw is reachable from the network layer without requiring physical device access.
RemediationAI
Upgrade to a patched EmberZNet SDK release published in the SiliconLabsSoftware/sisdk-release repository (https://github.com/SiliconLabsSoftware/sisdk-release) beyond version 9.0.2; the exact fixed release version was not independently confirmed from the available data - consult the vendor advisory at https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pYDOwIAO?operationContext=S1 for the confirmed patch version. If an immediate SDK upgrade is not feasible, restrict Zigbee network membership to pre-authorized devices via network-layer access controls or commissioning policies, reducing the pool of authenticated nodes that can send crafted frames. Additionally, deploying Zigbee traffic monitoring at gateway ingress to detect anomalously large or malformed frame lengths can serve as a detection compensating control. Note that restricting network membership may impact device onboarding workflows and should be evaluated against operational requirements.
Predictable cryptographic key generation in Silicon Labs EFR32xG27 wireless SoCs stems from incorrect use of the on-chip
Denial of service in Silicon Labs SiSDK v2026.6.0 and earlier affects EFR32MG24 and EFR32MG26 wireless SoCs running conc
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today