CVE-2026-6432: Improper bounds validation in EmberZNet SDK
Improper bounds validation in EmberZNet SDK versions 9.0.2 and earlier may result in crashes or dynamic memory leakage.
Other sources
Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 (inclusive) and before 7.5.2 (exclusive) may result in crashes or dynamic memory leakage. In order to exploit this vulnerability, an attacker would have to have the ability to send arbitrary messages on the network. The only known exploit of this vulnerability leaks a limited number of bytes from the stack. No denial-of-service, memory corruption, or remote code execution has been shown.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to send arbitrary messages on the affected network. The data does not indicate that exploitation is possible from outside the network without that message-sending capability.
Which SDK versions are affected?
The general bounds-validation issue affects EmberZNet SDK 9.0.2 and earlier. The ZAP command-parser issue affects versions 8.0.0 through 9.1.1 inclusive, as well as versions before 7.5.2.
What is the demonstrated impact?
The only known exploit leaks a limited number of bytes from the stack. Although crashes or dynamic memory leakage may result, no denial of service, memory corruption, or remote code execution has been shown.