Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. (CVE-2026-45811)
Source GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 1.10.0
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHub Actionsapache/mynewt-nimblepkg:github/apache/mynewt-nimbleOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade Apache NimBLE to version 1.10.0 or later where this vulnerability is fixed. Since the vulnerability requires specific conditions (misconfigured pool size or malicious controller on the HCI socket), ensure proper configuration of the event pool size and restrict access to the HCI socket link to trusted controllers. Patch status is confirmed fixed in version 1.10.0.
Description
A buffer overflow vulnerability exists in Apache NimBLE through version 1.9.0 due to improper size checking when copying received HCI events into the event pool. Exploitation requires a misconfigured event pool size or a malicious/compromised controller on the HCI socket link, and cannot be triggered via over-the-air Bluetooth access. The vulnerability is fixed in version 1.10.0.
Impact
Successful exploitation can lead to high impact including confidentiality, integrity, and availability compromise due to buffer overflow. However, exploitation is limited to scenarios involving local or direct access to the HCI socket link with a malicious or compromised controller or misconfiguration, not remote Bluetooth attacks.
Summary
CVE-2026-45811 is a classic buffer overflow vulnerability in Apache NimBLE versions prior to 1.10.0. The flaw arises because the HCI socket transport does not verify whether a received HCI event fits within the configured event pool before copying it, potentially leading to memory corruption. Exploitation requires either a misconfigured pool size or a malicious or compromised controller on the HCI socket link, meaning remote over-the-air Bluetooth exploitation is not possible. The issue is addressed in Apache NimBLE version 1.10.0.
Weaknesses
References
- nvd.nist.gov/vuln/detail/CVE-2026-45811 (opens in a new tab)
- github.com/apache/mynewt-nimble/commit/dcc4e4f026109eecd507de9479bb5019306a4a41 (opens in a new tab)
- lists.apache.org/thread/5mkz68y1py0o6zmxtc3l1o8grtrb78m0 (opens in a new tab)
- openwall.com/lists/oss-security/2026/07/24/11 (opens in a new tab)