# CVE-2026-6432: Silicon Labs EmberZNet SDK improper bounds validation

Source: https://junglewise.ai/threats/cve-2026-6432-silicon-labs-emberznet-sdk-improper-bounds-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-6432 · Severity: info · CVSS 5.3 · Published 2026-06-25

A vulnerability exists in the Silicon Labs EmberZNet SDK, a software development kit used to build Zigbee-based smart home and industrial IoT devices. An attacker could exploit this flaw to cause affected devices to crash or leak internal memory information. This could lead to service disruptions or the exposure of sensitive data handled by the connected device.

Vendors: [Silicon Labs](https://junglewise.ai/threats/vendors/silicon-labs).

## Quick answers

**Is CVE-2026-6432 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6432 being exploited in the wild.

**How severe is CVE-2026-6432?** Informational severity, with a CVSS score of 5.3, published 25 June 2026.

**Which products and versions are affected?** Silicon Labs EmberZNet SDK 9.0.2 and earlier.

**Is there a fix for CVE-2026-6432?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6432 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6432?** Check whether you run Silicon Labs EmberZNet SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as CWE-130 (Improper Handling of Length Parameter Inconsistency) within the EmberZNet SDK. It stems from improper bounds validation when processing input, which can lead to an out-of-bounds condition. An attacker with low privileges can exploit this over a network to trigger a denial-of-service (crash) or leak dynamic memory contents. The issue affects versions 9.0.2 and earlier of the SDK, which is part of the Silicon Labs SiSDK (Simplicity SDK).

## Affected products

- Silicon Labs EmberZNet SDK (SiSDK) 9.0.2 and earlier

## Timeline

- 2026-06-25: disclosed
- 2026-06-25: advisory

## References

- [https://github.com/SiliconLabsSoftware/sisdk-release](https://github.com/SiliconLabsSoftware/sisdk-release)
- [https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pYDOwIAO?operationContext=S1](https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000pYDOwIAO?operationContext=S1)