CVE-2026-85079

CriticalCVSS 9.8/10Last modified Oct 29, 2026

Description

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Oct 22, 2026
Last modified: Oct 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-85086.5An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 cou CVE-2026-850809.1In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited nu CVE-2026-850817.5The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.CVE-2026-850828.5Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename CVE-2026-850836.8The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device m CVE-2026-850846.3Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buff CVE-2026-850859.6The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page l CVE-2026-850866.9Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This CVE-2026-850876.9Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Th CVE-2026-850886.9Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default acces CVE-2026-850896.5FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. T CVE-2026-85098.8Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox