CVE-2026-19293 silabs.com CVE debrief

Who should care

Defenders and security teams responsible for configuring and maintaining encryption key sizes in their systems should assess their exposure to potential brute-force attacks. This includes operators of affected platforms, vulnerability management teams, and security teams that need to review and update security configurations. They should verify encryption key sizes used in systems, assess exposure to potential brute-force attacks, and review and update  

Why it matters

CVE-2026-19293 is a high-severity vulnerability that allows for easier brute-forcing of encryption keys due to the lack of maximum encryption key size support in SMP security requests. Defenders should prioritize verifying encryption key sizes and assessing exposure to potential brute-force attacks.

• Easier brute-forcing of encryption keys may lead to increased risk of key compromise
• Defenders need to verify encryption key sizes used in their systems
• Security configurations may need to be reviewed and updated

Technical summary

The CVE-2026-19293 vulnerability is related to the SMP security request not including the maximum encryption key size supported. This omission makes brute-forcing the key easier. The issue is discussed in the BLERP paper on BLE re-pairing attacks and defenses. Affected product deployments should be identified, and owners assigned for follow-up. The CVE record and NVD vulnerability detail page provide information on the vulnerability, but the vendor and affected products are not clearly identified. Defenders should prioritize verifying the encryption key sizes used in their systems and assess exposure to potential brute-force attacks.

Defensive priority

Defenders should prioritize verifying the encryption key sizes used in their systems and assess exposure to potential brute-force attacks.

Recommended defensive actions

• Verify encryption key sizes used in systems
• Assess exposure to potential brute-force attacks
• Review and update security configurations
• Implement compensating controls for exposed systems
• Monitor relevant logs for exposed assets
• Perform asset inventory to identify potentially affected systems
• Review vendor patch guidance for affected products

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, but the vendor and affected products are not clearly identified. The BLERP paper is referenced as a source of additional information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.