Improper Bounds Validation in EmberZNet SDK

Publication date: 2026-06-25

Last updated on: 2026-10-15

Assigner: Silicon Graphics (SGI)

Description

Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage. In order to exploit this vulnerability, an attacker would have to have the ability to send arbitrary messages on the network. The only known exploit of this vulnerability leaks a limited number of bytes from the stack. No denial-of-service, memory corruption, or remote code execution has been shown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-06-25

EPSS Evaluated

2026-10-18

NVD

CVE-2026-6432

EUVD

EUVD-2026-39411

Affected Vendors & Products

Vendor	Product	Version / Range
silabs	emberznet_sdk	to 9.0.2 (exc)
siliconlabs	emberznet_sdk	to 9.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-130	The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper bounds validation in the EmberZNet SDK versions 9.0.2 and earlier. Due to this flaw, the software may experience crashes or dynamic memory leakage when processing certain inputs or operations.

Impact Analysis

The impact of this vulnerability includes potential crashes of the affected software, which can lead to denial of service or instability. Additionally, dynamic memory leakage may occur, potentially degrading system performance or causing unexpected behavior over time.

Hi! I’m here to help you understand CVE-2026-6432. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70