Skip to content
Sign in
5.3 Medium

CVE-2026-6432 Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and…

Description

Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage. In order to exploit this vulnerability, an attacker would have to have the ability to send arbitrary messages on the network. The only known exploit of this vulnerability leaks a limited number of bytes from the stack. No denial-of-service, memory corruption, or remote code execution has been shown.

Affected products and versions

Product Affected versions Fixed in
SiSDK Versions not published
EmberZNet 8.0 8.0.0 → 9.1.1 No fix stated
EmberZNet 7.5 earliest → 7.5.1 No fix stated

Other CVEs of SiSDK

The 3 CVEs of SiSDK →
CVE-2026-17610 In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service 6.0 Medium CVE-2026-2815 Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys 8.4 High
Track this CVE