The EmberZNet SDK contains an improper bounds validation flaw that allows unsafe array operations, which can cause the SDK to crash or leak dynamic memory. This defect undermines system stability and may expose sensitive data through unintended memory disclosures.

Silicon Labs SiSDK – EmberZNet SDK version 9.0.2 and all earlier releases that have not been updated contain the vulnerability. Devices using these SDK components to process network or firmware inputs are susceptible.

The CVSS score of 5.3 reflects a moderate risk. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is delivering crafted payloads that trigger out‑of‑bounds indices to the SDK through network interfaces or firmware update channels, as inferred from the description that the SDK processes network or firmware inputs. Exploitation does not require privileged access but needs the SDK to process malicious input, and results may manifest as application crashes or abnormal memory usage.