Improper bounds validation in EmberZNet SDK
Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage. In order to exploit this vulnerability, an attacker would have to have the ability to send arbitrary messages on the network. The only known exploit of this vulnerability leaks a limited number of bytes from the stack. No denial-of-service, memory corruption, or remote code execution has been shown.
CVE-2026-6432
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-6432
EmberZNet
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/SiliconLabsSoftware/sisdk-release",
"vendor": "Silicon Labs",
"product": "EmberZNet",
"versions": [
{
"status": "affected",
"version": "8.0.0",
"versionType": "semver",
"lessThanOrEqual": "9.1.1"
},
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "7.5.1"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-6432
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #28762 · Revision 1
- Added to Heist Feed
- Publisher date