TI-2026-79281 Aliases CVE-2026-85080 GHSA-2j8f-gm3f-3335

Out-of-bounds write in EmberZNet GetGroupMembership handling

LOW 27CWE-121Published 2026-10-22 · Updated 2026-10-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Silicon Labs EmberZNet through 9.1.1 contains a stack-based buffer overflow (CWE-121) in Zigbee GetGroupMembership handling. A malformed message from a device that has already joined the network causes an out-of-bounds write that crashes the device. Only devices supporting the Group Cluster are affected, and no route to remote code execution was observed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00498 42nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
silabs.com	EmberZNet	up to 9.1.1	—	No fix listed	CNA

EmberZNet Vendorsilabs.com Affected up to 9.1.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:silabs:emberznet::::::::	up to 9.1.1	Vulnerable	silabs.com

cpe:2.3:a:silabs:emberznet:*:*:*:*:*:*:*:* Versions up to 9.1.1 Vulnerable ·silabs.com

Remediation

The sources list no fixed version for EmberZNet.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-10-22
Silicon Labs EmberZNet — github.com/SiliconLabsSoftware/docs-security-advisories/blo…
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-79277 Uncontrolled recursion in EmberZNet Publish Billing Period handlingPriority LOW 27
- TI-2026-79276 Infinite loop in Silicon Labs EmberZNet Discover Attributes handlingPriority LOW 27
Show all 3 records → Advisory →

Timeline

2026-10-22 Threatist record created from CVE-2026-85080
2026-10-22 Alias added: GHSA-2j8f-gm3f-3335
2026-10-23 CISA SSVC decision points changed
2026-10-23 Priority changed: MEDIUM → LOW
2026-10-29 CVSS score added · NVD

References

Advisory 1

https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000590.md

TI-2023-21716 Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNet CVSS 3.1CRITICAL 10.0
TI-2022-08741 Malformed Zigbee packet causes Assert in EmberZNet 7.0.0 or earlier CVSS 3.1CRITICAL 9.8
TI-2023-28047 Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM CVSS 3.1CRITICAL 9.8
TI-2022-08742 Malformed Zigbee packet causes Assert in EmberZNet 7.0.1 or earlier CVSS 3.1HIGH 7.5
TI-2023-28049 Potential DoS for EFR32xxx parts in high traffic environments due to null buffer dereference / crash CVSS 3.1HIGH 7.5
TI-2023-28048 Potential DoS due to BusFault and Assert in Ember ZNet legacy packet buffer CVSS 3.1HIGH 7.5

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences