Description
In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Silicon Labs | Z-Wave SDK | ≤ 8.1.1 | — |
Medium · 5.1
CVE-2026-89410
EUVD-2026-108187GHSA-39xw-g2p8-jwq5
Out-of-bounds read in Z-Wave NCP SPI Handler
Published Oct 22, 2026 · Updated Oct 23, 2026 · Assigned by Silabs