This vulnerability arises from a malformed NCP SPI command that triggers an out‑of‑bounds read within Silicon Labs Z‑Wave SDK 8.1.1 and earlier, allowing an attacker to read memory beyond the intended buffer and leak sensitive data. The weakness corresponds to CWE‑1285, a buffer overread that can disclose confidential information. No code execution is possible; the impact is limited to information disclosure.

Affected systems are devices and applications that rely on Silicon Labs Z‑Wave SDK version 8.1.1 or older, a component commonly integrated into Z‑Wave controllers and transceivers. The vulnerability resides in the NCP SPI handler of this SDK.

The CVSS score of 5.1 categorizes the issue as moderate risk. EPSS is not available, so the probability of exploitation is uncertain but likely low. The vulnerability is not listed in CISA KEV, indicating no known active exploitation. The attack requires ability to send a crafted NCP SPI command; devices that restrict access to the SPI interface or isolate the controller in a secure segment will reduce the threat surface.