Is CVE-2026-89410 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89410 being exploited in the wild.

How severe is CVE-2026-89410?

Informational severity, published 22 October 2026.

Which products and versions are affected?

Silicon Labs Z-Wave SDK 8.1.1 and earlier (700 and 800 series); 7.21.x and earlier (Z-Wave SDK).

Is there a fix for CVE-2026-89410?

Yes: fixed in Z-Wave SDK 8.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-89410 attacked?

It is attacked with physical access, in a software library.

Am I affected by CVE-2026-89410?

Check whether you run Silicon Labs Z-Wave SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89410: Silicon Labs Z-Wave SDK out-of-bounds read in NCP Serial API

CVE-2026-89410 · Severity: info · Published 2026-10-22

Silicon Labs Z-Wave SDK, used in wireless security and automation devices, contains an out-of-bounds read vulnerability in its serial command handler. An attacker with physical access to the device's NCP UART interface can exploit this flaw to leak sensitive data, including device decryption keys, which could enable unauthorized access to encrypted device firmware and configuration.

Vendors: Silicon Labs.

Quick answers

Is CVE-2026-89410 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89410 being exploited in the wild.
How severe is CVE-2026-89410?: Informational severity, published 22 October 2026.
Which products and versions are affected?: Silicon Labs Z-Wave SDK 8.1.1 and earlier (700 and 800 series); 7.21.x and earlier (Z-Wave SDK).
Is there a fix for CVE-2026-89410?: Yes: fixed in Z-Wave SDK 8.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89410 attacked?: It is attacked with physical access, in a software library.
Am I affected by CVE-2026-89410?: Check whether you run Silicon Labs Z-Wave SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Z-Wave SDK 8.1.2 or later

Technical details

An incorrect bounds check in the Z-Wave NCP Serial API command handler permits out-of-bounds memory reads when processing malformed SPI commands. The vulnerable code exposes sensitive regions including upgrade decryption keys on EFR32ZG23 devices. Attack requires physical access to the device's UART interface; exploitation decrypts GBL upgrade files and compromises device security.

Affected products

Silicon Labs Z-Wave SDK 8.1.1 and earlier (700 and 800 series); 7.21.x and earlier (Z-Wave SDK)

Timeline

2026-10-22: disclosed

References

https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000592.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.