CVE-2026-85079: Out-of-bounds write in Zigbee Simple_Desc_req handling
Published Oct 22, 2026
·Updated
In EmberZNet 9.1.1 and earlier, a malformed SimpleDescreq response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a SimpleDescreq before the attack can be performed.
Affected Software
1 affected component
Silicon Labs EmberZNet<=9.1.1
Event History
Oct 22, 2026
CVE Published
via MITRE·01:46 PM
Data Sourced
via MITRE·01:46 PM
DescriptionWeakness
Frequently Asked Questions
1
Which deployments are exposed to this issue?
Deployments using EmberZNet 9.1.1 or earlier may be exposed. Exploitation requires a malicious device that has already joined the Zigbee network.
2
What conditions must an attacker satisfy to exploit the vulnerability?
The attacker must send a malformed Simple_Desc_req response from a device already joined to the network. They must also wait until a Simple_Desc_req is issued before performing the attack.