Out-of-bounds write in Apache NimBLE - CVE-2026-45813
Published: August 24, 2026
Vulnerability identifier: #VU144750
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45813
CWE-ID: CWE-787
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service or disclose sensitive information.
The vulnerability exists due to improper input validation in the BASS service add/modify source operation parser when parsing BASS service "Add Source" and "Modify Source" operation PDUs over a Bluetooth connection. A remote user can send a specially crafted PDU to cause a denial of service or disclose sensitive information.
Pairing is required prior to accessing the BASS service, and depending on device configuration this may require user interaction.
Affected software
Apache NimBLE
How to mitigate CVE-2026-45813
Install security update from vendor's website.
Apache NimBLE - update to 1.10.0