Quick answers
- Is CVE-2026-5706 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-5706 being exploited in the wild.
- How severe is CVE-2026-5706?
- Informational severity, with a CVSS score of 7.5, published 28 August 2026.
- Which products and versions are affected?
- Silicon Labs Bluetooth Mesh SDK 6.1.4 and earlier.
- Is there a fix for CVE-2026-5706?
- A patch was published on 2025-10-08: Fixed in Bluetooth Mesh SDK 6.1.5.0 (GSDK v4.5.0) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-5706 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-5706?
- Check whether you run Silicon Labs Bluetooth Mesh SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stack-based buffer overflow triggered by out-of-bounds writes when processing malformed extended advertisements in Bluetooth Mesh SDK 6.1.4 and earlier. The attack requires the attacker to be authenticated as a device already joined to the mesh network, limiting the attack surface to provisioners with extended advertisement support enabled. The malformed messages trigger memory corruption that can be leveraged to achieve remote code execution. Patches are available in Bluetooth Mesh SDK 6.1.5.0 and later (confirmed in GSDK v4.5.0 and v4.5.1).
Affected products
- Silicon Labs Bluetooth Mesh SDK 6.1.4 and earlier
Timeline
- 2026-08-28: disclosed
- 2025-10-08: patched: Fixed in Bluetooth Mesh SDK 6.1.5.0 (GSDK v4.5.0)