Medium severity · published Oct 22, 2026
CVE-2026-89410
Out-of-bounds read in Z-Wave NCP SPI Handler
New
5.1
CVSS
0.2%
EPSS
No
On KEV
Description
In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZS
Z-Wave SDK · Silicon Labs
through 8.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89410
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89410
github.com
https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000592.md
More from Z-Wave SDK
5.3
CVE-2026-89409
Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes