Out-of-Bounds Read Vulnerability in EmberZNet by Silicon Labs

CVE-2026-47149

What is CVE-2026-47149?

In versions of EmberZNet prior to v9.0.2, vulnerabilities arise from improperly handled Door Lock user identifiers, which can result in out-of-bounds table reads. Such malformed identifiers, when processed, may lead to unexpected behavior and potentially terminate the service process. It's critical to note that these issues can only be triggered by devices that have been previously authenticated on the network, thereby limiting exposure, and no data leakage back to the originating device has been reported. Devices that engage with the Door Lock cluster are specifically at risk.

References