CVE-2026-85079 is a stack-based out-of-bounds write in Silicon Labs' EmberZNet Zigbee stack, triggered when a device already joined to the network sends a malformed Simple_Desc_req response, and NVD's own analysis scores it 9.8 critical because Silicon Labs confirms this can lead to remote code execution on devices that have not enabled RAM execution-prevention protection.
Vulnerability summary
9.8
Critical
0.7%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-22
Published
Vulnerability ID: CVE-2026-85079 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Silicon Labs EmberZNet (Zigbee stack) | cpe:2.3:a:silabs:emberznet:*:*:*:*:*:*:*:* | EmberZNet 9.1.1 and earlier as shipped in SiSDK 2026.6.1 and earlier, and EmberZNet 7.5.2 and earlier as shipped in all released GSDK versions; fixed for SiSDK in 2026.6.2, no GSDK fix available |
What this means
CVE-2026-85079 is an out-of-bounds write (CWE-121) in Silicon Labs' EmberZNet software, the Zigbee protocol stack embedded in a wide range of Zigbee radio chips and modules. The vulnerability is triggered by a malformed Simple_Desc_req response; because this is a response rather than an unsolicited message, the attacking device must already be joined to the Zigbee network and the target must first send a Simple_Desc_req before the attack becomes possible — Silicon Labs notes there is no additional cluster-support requirement for this particular flaw, unlike the related CVE-2026-94502 (out-of-bounds write in Publish Price Matrix handling, which requires the Price cluster to be active) disclosed in the same advisory (Silicon Labs Security Advisory A-00000589).
Silicon Labs states that out-of-bounds writes in EmberZNet "may lead to remote code execution if execution from RAM has not been disabled," and credits the discovery to Junming C. (@Chapoly1305) and Prof. Qiang Zeng of George Mason University (Silicon Labs Advisory A-00000589).
NVD performed its own CNA analysis and assigned a Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; Silicon Labs' own CNA submission rates it lower, CVSS v4.0 7.5 (Secondary), vector CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H, reflecting the network-adjacent, already-joined-device precondition (NVD).
Affected versions are EmberZNet 9.1.1 and earlier as distributed in Silicon Labs' SiSDK 2026.6.1 and earlier, and EmberZNet 7.5.2 and earlier as distributed in every released version of the older GSDK. Silicon Labs' primary mitigation is not a code patch but a configuration change: enabling the "Platform > Security > Memory Protection Unit > Simple MPU" component in a project's Simplicity Studio .slcp file, which makes RAM non-executable and blocks the RCE escalation path; this component is not included by default in affected SDK versions. A fixed EmberZNet is available for SiSDK users via SiSDK 2026.6.2 or later; as of publication, Silicon Labs states no fix is available for GSDK (Silicon Labs Advisory A-00000589).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.00655 (51.4th percentile) (FIRST EPSS). It is not listed in the CISA Known Exploited Vulnerabilities catalog (checked against catalog version 2026.10.30). Because EmberZNet underlies a broad base of commercial Zigbee smart-home and building-automation devices (locks, lighting, sensors, hubs) and the vulnerability requires only network membership rather than any cluster-specific feature, device makers and integrators running affected SDK versions should enable the Simple MPU protection immediately and plan to move to SiSDK 2026.6.2 for GSDK deployments where no direct fix yet exists.
Evidence
- Out-of-bounds write triggered by a malformed Simple_Desc_req response from a device already joined to the network; Silicon Labs states this may lead to remote code execution if RAM execution has not been disabled. — Silicon Labs Security Advisory A-00000589
- NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; Silicon Labs' own CNA submission scores it CVSS v4.0 7.5 (Secondary). — NVD
- Affects EmberZNet 9.1.1 and earlier (SiSDK 2026.6.1 and earlier) and EmberZNet 7.5.2 and earlier (all released GSDK); mitigation is enabling the Simple MPU component; fixed in SiSDK 2026.6.2; no GSDK fix available at publication. — Silicon Labs Security Advisory A-00000589
- EPSS score is 0.00655 (51.4th percentile) as of 2026-10-30; not listed in CISA KEV as of catalog version 2026.10.30. — FIRST EPSS
