How severe is CVE-2026-6432?

CVE-2026-6432 has a CVSS 4.0 base score of 5.3, rated medium severity.

Is CVE-2026-6432 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-6432?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-6432 have an EU (EUVD) identifier?

Yes. CVE-2026-6432 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-39411.

When was CVE-2026-6432 published?

CVE-2026-6432 was published on 2026-06-25.

CVE-2026-6432

CVE-2026-6432 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-130.

Key facts

Severity: Medium (CVSS 4.0 base score 5.3)
EPSS exploit prediction: 0% (23rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-39411
Weakness: CWE-130
Published: 2026-06-25
Last modified: 2026-06-25

Description

Improper bounds validation in EmberZNet SDK versions 9.0.2 and earlier may result in crashes or dynamic memory leakage.

Frequently asked questions

What is CVE-2026-6432?: Improper bounds validation in EmberZNet SDK versions 9.0.2 and earlier may result in crashes or dynamic memory leakage.
How severe is CVE-2026-6432?: CVE-2026-6432 has a CVSS 4.0 base score of 5.3, rated medium severity.
Is CVE-2026-6432 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-6432?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-6432 have an EU (EUVD) identifier?: Yes. CVE-2026-6432 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-39411.
When was CVE-2026-6432 published?: CVE-2026-6432 was published on 2026-06-25.

References

Other CWE-130 vulnerabilities

CVE-2022-2714 — Critical (CVSS 9.8): Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.
CVE-2026-9054 — Critical (CVSS 9.2): An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel…
CVE-2022-1543 — High (CVSS 8.8): Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large…
CVE-2026-3868 — High (CVSS 8.7): An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure…
CVE-2026-5367 — High (CVSS 8.6): A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host…
CVE-2022-20870 — High (CVSS 8.6): A vulnerability in the egress MPLS packet processing function of Cisco IOS XE Software for Cisco Catalyst 3650,…

Browse all CWE-130 vulnerabilities →