A malformed Bluetooth connection request message containing an inflated length field triggers a memory leak in the RS9116W/SiWx917 firmware, potentially exposing sensitive information that resides in memory. The vulnerability manifests as a buffer over-read (CWE‑126) and does not directly allow code execution or denial of service; its primary consequence is inadvertent information disclosure.

Silicon Labs WiseConnect RS9116W/SiWx917 wireless modules are affected. Specific firmware or hardware revision identifiers are not supplied in the data, so all variants of this device family should be considered potentially vulnerable until a vendor advisory clarifies the scope.

The CVSS base score of 5.3 indicates a moderate threat level for confidentiality impacts. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, publicly known exploitation is unlikely but not ruled out. Inferred from the description, the attack vector is likely remote via a Bluetooth connection request, implying that an adversary can trigger the leak by sending a crafted packet without any authentication or privileged access.