SB20260824135 - Multiple vulnerabilities in Apache NimBLE

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260824135

SB20260824135 - Multiple vulnerabilities in Apache NimBLE

Published: August 24, 2026

Security Bulletin ID SB20260824135
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2026-45811)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 2.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to classic buffer overflow in HCI socket transport when processing a received HCI event. A remote attacker can send a specially crafted HCI event to cause a denial of service.

Exploitation requires either a misconfigured event pool size or a malicious or compromised controller on the other end of the HCI socket link, and does not occur over-the-air Bluetooth access.


2) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-45812)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to incorrect calculation of buffer size in the legacy advertising report hci event handler when processing bundled hci advertising report events containing multiple reports. A remote attacker can send a specially crafted advertising report event to disclose sensitive information.

This only affects deployments where NimBLE host is used with a third-party controller that batches multiple reports into a single event.


3) Out-of-bounds write (CVE-ID: CVE-2026-45813)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service or disclose sensitive information.

The vulnerability exists due to improper input validation in the BASS service add/modify source operation parser when parsing BASS service "Add Source" and "Modify Source" operation PDUs over a Bluetooth connection. A remote user can send a specially crafted PDU to cause a denial of service or disclose sensitive information.

Pairing is required prior to accessing the BASS service, and depending on device configuration this may require user interaction.


4) Reachable assertion (CVE-ID: CVE-2026-45815)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to reachable assertion in ATT Read Multiple Variable Response handler when parsing a specially crafted ATT Read Multiple Variable Response. A remote attacker can send a specially crafted ATT Read Multiple Variable Response to cause a denial of service.

Exploitation requires the device under test to first send an ATT Read Multiple Variable Request.


5) NULL pointer dereference (CVE-ID: CVE-2026-45816)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the LE Long Term Key Request event handling when processing a bogus controller LTK request. A remote attacker can trigger the vulnerable event to cause a denial of service.

Exploitation requires disabled asserts and a bogus or misbehaving controller.


6) Input validation error (CVE-ID: CVE-2026-46452)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in mesh proxy SAR reassembly when processing crafted mesh proxy SAR data. A remote attacker can send malformed reassembly input to cause a denial of service.

The issue could result in broken data being passed toward the application, leading to memory pressure and unstable parsing behavior.


Remediation

Install update from vendor's website.

References