The vulnerability is an integer underflow in Silicon Labs Secure NCP host that leads to a buffer overread when a specially crafted packet is processed. This flaw can reveal data located after the intended buffer boundary, potentially exposing sensitive information stored in memory. The weakness is identified as a data truncation or arithmetic error that miscalculates packet lengths.

Silicon Labs products using the Simplicity SDK and Gecko SDK are affected. No specific version numbers are listed in the advisory, so any release built with the vulnerable code segment may be at risk.

The CVSS score of 2.4 indicates low severity, and the EPSS score of less than 1% reflects a very low probability of exploitation. The flaw is not included in the CISA KEV catalog, suggesting no public exploitation has been observed. The likely attack vector involves an adversary sending a malicious packet over the network to the device, which is the inferred path for triggering the underflow. Because the vendor has not released an official patch or workaround, the risk remains limited but should be measured against the device’s exposure to untrusted networks.