CVE-2026-89410: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input in Silicon Labs Z-Wave SDK

This vulnerability (CWE-1285) affects Silicon Labs Z-Wave SDK versions 0 through 8.1.1. It arises from improper validation of input parameters in NCP SPI commands, allowing out-of-bounds memory reads. These reads can lead to leakage of sensitive information from memory. The CVSS 4.0 base score is 5.1, indicating a medium severity with a local attack vector and high impact on confidentiality. There is no indication of privilege requirements, user interaction, or availability impact. No known exploits are reported in the wild, and no official patch or remediation information is provided in the available data.

Successful exploitation can result in leakage of sensitive information due to out-of-bounds reads triggered by malformed NCP SPI commands. The confidentiality impact is high, but there is no impact on integrity, availability, or other security properties. The attack vector is physical or local (AV:P), requiring low attack complexity and no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor Silicon Labs advisories for updates. Until a fix is available, restrict access to interfaces that can send NCP SPI commands to trusted entities only.