Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 25

CVE-2026-66281

Authenticated Denial-of-Service in Zigbee Discover Attributes Handling

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-66282

Authenticated Denial-of-Service in Zigbee Publish Billing Period

In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-85079

Out-of-bounds write in Zigbee Simple_Desc_req handling

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-85080

Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-94502

Out-of-bounds write in Zigbee Publish Price Matrix handling

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-6432

Improper bounds validation in EmberZNet SDK

Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage. In order to exploit this vulnerability, an attacker would have to have the ability to send arbitrary messages on the network. The only known exploit of this vulnerability leaks a limited number of bytes from the stack. No denial-of-service, memory corruption, or remote code execution has been shown.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Silicon Labs
Products
Sisdk
CVE-2026-15417

CP210x Denial of Service

In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Silicon Labs
Products
Silabser.sys Driver
CVE-2026-15418

CP210x Memory Leakage

In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 145 bytes of uninitialized kernel pool memory. This vulnerability affects Windows 10 and earlier.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Silicon Labs
Products
Silabser.sys Driver
CVE-2026-15419

CP210x Driver Memory Corruption results in Arbitrary Code Execution

In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kernel pool memory, resulting in arbitrary code execution with escalated privileges.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Silicon Labs
Products
Silabser.sys Driver
CVE-2026-5706

Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may be impacted.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Silicon Labs
Products
Bt Mesh Sdk
CVE-2026-17610

RAIL 802.15.4 Mux missing ACK can lead to DoS

In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This is only present for EFR32MG24 and EFR32MG26 devices running concurrent multiprotocol Zigbee and Thread.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Silicon Labs
Products
Sisdk
CVE-2026-6924

Weak entropy initialization in Silicon Labs Matter SiWx917 TinyCrypt path

A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Silicon Labs
Products
Silicon Labs Matter Github
CVE-2026-2815

Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys

Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Silicon Labs
Products
Sisdk
CVE-2026-4526

Global ZCL command parser missing minimum-length validation in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47145

Color Control hue/saturation assertion abort in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47146

Color Control color-temperature assertion abort in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47147

OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47148

Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Groups cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47149

Door Lock GetUserType invalid table index in EmberZNet v9.0.2

In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Door Lock cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet
CVE-2026-47150

IAS Zone enroll invalid table index and write in EmberZNet 9.0.2

In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may be impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Silabs Silicon Labs
Products
Emberznet Emberznet