CVE-2026-94502: Out-of-bounds write in Zigbee Publish Price Matrix handling

Q: Which deployments are exposed to this issue?

EmberZNet 9.1.1 and earlier are affected only on devices that support the Zigbee Price Cluster. Devices without Price Cluster support are not impacted.

Q: What access does an attacker need to exploit it?

The attacker must send a malformed Publish Price Matrix command from a device that has already joined the Zigbee network. The available information does not indicate that an unauthenticated, non-member device can exploit the issue.

Published Oct 22, 2026

Updated

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

Affected Software

1 affected component

Silicon Labs EmberZNet<=9.1.1

Event History

Oct 22, 2026

CVE Published

via MITRE·01:45 PM

Data Sourced

via MITRE·01:45 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

EmberZNet 9.1.1 and earlier are affected only on devices that support the Zigbee Price Cluster. Devices without Price Cluster support are not impacted.

What access does an attacker need to exploit it?

The attacker must send a malformed Publish Price Matrix command from a device that has already joined the Zigbee network. The available information does not indicate that an unauthenticated, non-member device can exploit the issue.