Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability
Priority MEDIUM 49CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code Injection, Authentication Bypass.This issue affects "Standalone" and "Application" versions of Gecko Bootloader.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00398 34th percentileScored 2026-11-07
Fix Fixed Gecko Bootloader (Silicon Labs): 4.3.1, 4.2.4, 4.3.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| silabs.com | Gecko Bootloader | before 4.3.1; before 4.2.4 | 4.3.1, 4.2.4, 4.3.2 | Patch available | CNA |
- Gecko Bootloader Vendorsilabs.com Affected before 4.3.1; before 4.2.4 Fixed in 4.3.1, 4.2.4, 4.3.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:silabs:gecko_bootloader:*:*:*:*:*:*:arm:* | before 4.2.4; 4.3.0 to before 4.3.2 | Vulnerable | silabs.com |
- cpe:2.3:a:silabs:gecko_bootloader:*:*:*:*:*:*:arm:* Versions before 4.2.4; 4.3.0 to before 4.3.2 Vulnerable ·silabs.com
Remediation
- Fix · CNA Gecko Bootloader (Silicon Labs) Fixed in 4.3.1, 4.2.4, 4.3.2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4041
- 2026-10-03 Alias added: GHSA-hvfc-3xxp-p6hw
References
More silabs.com Gecko Bootloader vulnerabilities
- TI-2022-08740 Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices CVSS 3.1CRITICAL 9.1
- TI-2023-03255 Integer overflow in Silicon Labs Gecko Bootloader leads to unbounded memory access CVSS 3.1HIGH 7.8
Sources
- CVE-2023-4041 · CVE Program
- CVE-2023-4041 · NVD
- FIRST EPSS
- GHSA-hvfc-3xxp-p6hw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences