CVE-2025-36939 describes multiple vulnerabilities in the OpenThread component used by Google Nest devices, specifically in the processing of MLE (Mesh Link Establishment) packets. An attacker authenticated on the same Thread network can send crafted packets to trigger assertion failures and a stack-based buffer overflow, resulting in denial of service conditions. The vulnerability has a critical severity rating with a CVSS 4.0 score of 10, indicating network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, availability, scope, and security requirements. The affected version is exactly 3.78.518349. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker on the same Thread network can cause denial of service on affected Google Nest devices by exploiting assertion failures and a stack-based buffer overflow in OpenThread's MLE packet handling. This can disrupt device availability and potentially impact network stability. The vulnerability does not require privileges or user interaction, increasing its risk within the local network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is available at this time. Users should monitor for updates from Google regarding patches or mitigations for this vulnerability.