CVE-2026-19293
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.
Risk Assessment
Using a weaker encryption key increases the risk of Bluetooth communication interception and decryption, potentially leading to data confidentiality breaches.
Recommendation
Update Bluetooth device firmware to a version that enforces the maximum encryption key size. Additionally, consider restricting the ability to negotiate lower security levels.
Original NVD description (English source)
SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.