CVE-2026-45812
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In Apache NimBLE, there is an incorrect calculation of buffer size when processing Legacy Advertising Report HCI events. When a single HCI event bundles multiple reports, NimBLE miscalculates the offset to the next report, potentially causing out-of-bounds reads and delivering bogus data to the application.
Risk Assessment
The risk is low because NimBLE's own controller never batches multiple reports; the issue only matters when paired with a third-party controller.
Recommendation
Upgrade to Apache NimBLE version 1.10.0, which fixes the vulnerability.
Other vulnerabilities in Apache NimBLE
See all- CVE-2025-62235High
A vulnerability in Apache NimBLE allows authentication bypass via spoofing. Receiving a specially crafted Security Request can lead to removal of the original bond and re-bonding with an impostor. The issue affects versions up to and including 1.8.0.
- CVE-2025-53477High
NULL Pointer Dereference vulnerability in Apache NimBLE. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low.
- CVE-2025-52435High
A vulnerability in Apache NimBLE stems from improper handling of the Pause Encryption procedure at the Link Layer, causing a previously encrypted connection to remain in an unencrypted state. This allows an attacker to eavesdrop on the remainder of the exchange. The issue affects versions up to and including 1.8.0.
- CVE-2026-46452Medium
Improper input validation in Apache NimBLE during Mesh Proxy SAR reassembly, potentially passing broken data to the application causing memory pressure and unstable parsing. Affects versions through 1.9.0. Fixed in 1.10.0.
- CVE-2026-45816High
NULL pointer dereference vulnerability in Apache NimBLE in the LE Long Term Key Request event. Requires disabled asserts and a bogus controller, so severity is low. Affects versions through 1.9.0. Fixed in 1.10.0.
- CVE-2026-45815High
Reachable assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response can trigger an assert in the ATT parser. Requires prior request from the DUT. Severity medium. Affects versions through 1.9.0. Fixed in 1.10.0.
- CVE-2026-45813High
Out-of-bounds write and integer underflow vulnerability in Apache NimBLE BASS service. Improper validation when parsing "Add Source" and "Modify Source" operations can lead to stack buffer overflow or arbitrary out-of-bound read. Requires pairing and authentication. Affects versions through 1.9.0. Fixed in 1.10.0.
- CVE-2026-45811High
In Apache NimBLE, there is a classic buffer overflow vulnerability in the HCI socket transport. The system did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow.
Original NVD description (English source)
Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the buffer and deliver a GAP event with bogus data to the application. Severity is low: NimBLE's own controller never batches multiple reports into one event, so this only matters when NimBLE's host is paired with a third-party controller that does. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.