Out-of-Bounds Read Vulnerability in Z-Wave SDK by Silicon Labs
CVE-2026-89410

5.1MEDIUM

Key Information:

Vendor

Silicon Labs

Status
Z-wave Sdk
Vendor
CVE Published:
22 October 2026

What is CVE-2026-89410?

In Z-Wave SDK version 8.1.1 and earlier, a vulnerability exists where a malformed Network Co-Processor (NCP) Serial Peripheral Interface (SPI) command can lead to out-of-bounds read conditions. This issue may expose sensitive information by allowing attackers to access unauthorized data. Proper input validation and handling of commands are crucial to mitigate this risk and protect sensitive data from potential leaks.

Affected Version(s)

Z-Wave SDK 0 <= 8.1.1

References

https://github.com/SiliconLabsSoftware/docs-security-advi...
vendor-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Physical
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.