CVE-2026-85080: Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling

Q: Which deployments are exposed to this issue?

Only EmberZNet devices that support the Zigbee Group Cluster are impacted. Devices that do not support that cluster are not affected by this message handling flaw.

Q: What access does an attacker need to trigger the crash?

The attacker must send the malformed GetGroupMembership message from a device that has already joined the Zigbee network. This is not described as exploitable by an unauthenticated device outside the network.

Q: Is remote code execution expected from this vulnerability?

No route to remote code execution was observed. The available write is limited to a small number of values, and the documented impact is a crash resulting in denial of service.

Published Oct 22, 2026

Updated

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.

Affected Software

1 affected component

Silicon Labs EmberZNet<=9.1.1

Event History

Oct 22, 2026

CVE Published

via MITRE·01:42 PM

Data Sourced

via MITRE·01:42 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Only EmberZNet devices that support the Zigbee Group Cluster are impacted. Devices that do not support that cluster are not affected by this message handling flaw.

What access does an attacker need to trigger the crash?

The attacker must send the malformed GetGroupMembership message from a device that has already joined the Zigbee network. This is not described as exploitable by an unauthenticated device outside the network.

Is remote code execution expected from this vulnerability?

No route to remote code execution was observed. The available write is limited to a small number of values, and the documented impact is a crash resulting in denial of service.