CVE-2026-85080

CriticalCVSS 9.1/10Last modified Oct 29, 2026

Description

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
Silicon Labs	EmberZNet	<= 9.1.1

References

https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000590.mdVendor Advisory

Timeline

Published: Oct 22, 2026
Last modified: Oct 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-850817.5The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.CVE-2026-850828.5Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename CVE-2026-850836.8The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device m CVE-2026-850846.3Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buff CVE-2026-850859.6The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page l CVE-2026-850866.9Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This CVE-2026-850876.9Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Th CVE-2026-850886.9Improper Validation of Certificate with Host Mismatch in the C++ and D libraries of Apache Thrift. Both libraries install a default acces CVE-2026-850896.5FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. T CVE-2026-85098.8Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox CVE-2026-850905.4FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane r CVE-2026-850917.4zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next