Out-of-Bounds Write Vulnerability in EmberZNet Software by Silicon Labs
CVE-2026-85079

7.5HIGH

Key Information:

Vendor

Silicon Labs

Status
Emberznet
Vendor
CVE Published:
22 October 2026

What is CVE-2026-85079?

In versions up to EmberZNet 9.1.1, a security vulnerability exists that allows an attacker to perform an out-of-bounds write. This occurs when a malformed Simple_Desc_req response is received from a device that has already joined the network. The attacker must initiate the exploit by waiting for this request, making it a targeted attack. If successful, this vulnerability could enable the execution of arbitrary code remotely, posing significant security risks to affected systems.

Affected Version(s)

EmberZNet 0 <= 9.1.1

References

https://github.com/SiliconLabsSoftware/docs-security-advi...
vendor-advisory

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Junming C. (@Chapoly1305) and Prof. Qiang Zeng of George Mason University
.