PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-89410 Silicon Labs CVE debrief

A vulnerability in Z-Wave SDK 8.1.1 and earlier allows for out-of-bounds reads that leak sensitive information when a malformed NCP SPI command is received. This issue can impact IoT security and device integrity. Defenders responsible for Z-Wave SDK implementations, IoT security teams, and vulnerability management teams should assess exposure and prioritize remediation. The vulnerability has a medium severity and can lead to potential information leaks. The CVE record and source item provide details on the vulnerability, but additional information from the vendor and other sources may be necessary for comprehensive risk assessment.

Vendor
Silicon Labs
Product
Z-Wave SDK
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-23
Advisory published
2026-10-22
Advisory updated
2026-10-23

Who should care

Defenders responsible for Z-Wave SDK implementations, IoT security teams, and vulnerability management teams should assess exposure and prioritize remediation.

Why it matters

CVE-2026-89410 is a medium-severity vulnerability in Z-Wave SDK 8.1.1 and earlier, allowing for out-of-bounds reads that leak sensitive information. Defenders should prioritize verifying and updating Z-Wave SDK versions to prevent potential information leaks.

  • Potential information leaks due to out-of-bounds reads
  • Need for verification and updating of Z-Wave SDK versions
  • Possible impact on IoT security and device integrity

Technical summary

The Z-Wave SDK 8.1.1 and earlier versions are vulnerable to out-of-bounds reads that can leak sensitive information when a malformed NCP SPI command is received. This vulnerability affects Z-Wave SDK implementations and can impact IoT security and device integrity. Defenders should prioritize verifying and updating Z-Wave SDK versions to prevent potential information leaks. The vulnerability is triggered by a malformed NCP SPI command, which can cause the system to perform out-of-bounds reads, potentially leading to information disclosure.

Defensive priority

Defenders should prioritize verifying and updating Z-Wave SDK versions to prevent potential information leaks.

Recommended defensive actions

  • Verify Z-Wave SDK version and update to a fixed version if available
  • Review and restrict NCP SPI command inputs to prevent malformed commands
  • Monitor for potential information leaks and implement compensating controls

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information from the vendor and other sources may be necessary for comprehensive risk assessment.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-89410 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-89410

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-89410 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-89410

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Out-of-bounds read in Z-Wave NCP SPI Handler

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89410.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000592.md

    Supplemental source - vendor-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.