Live › vulnerability › CVE-2026-85080
Go to dashboardEmberZNet 9.1.1 and earlier mishandle a malformed GetGroupMembership message, causing an out-of-bounds write that crashes the device. The sources say only a limited set of values can be written and no remote code execution route was observed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Zigbee devices running EmberZNet 9.1.1 or earlier that support the Group Cluster are impacted. The attacker must come from a device that has already joined the network, so networks with no untrusted joined devices are at lower risk.
No product ranges from the sources yet.
9.1.1, unknown exact fixed version in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.
This page as .md · .json · in your agent: get_signal("CVE-2026-85080")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.