CVE-2026-45811 is a classic buffer overflow vulnerability (CWE-120) in Apache NimBLE's HCI socket transport. The vulnerability arises because the code does not verify whether a received HCI event fits into the configured event pool before copying it, potentially causing a buffer overflow. This flaw affects Apache NimBLE versions up to and including 1.9.0. Exploitation requires local access to the HCI socket link with either a misconfigured pool size or a malicious/compromised controller, and is not exploitable via over-the-air Bluetooth. The Apache Software Foundation has addressed this issue in version 1.10.0.

Successful exploitation can lead to high impact including confidentiality, integrity, and availability compromise due to buffer overflow. However, the attack vector is limited to scenarios where the event pool is misconfigured or the attacker controls the HCI socket link, not via remote Bluetooth attacks. This limits the practical risk but does not eliminate the potential severity of the overflow.

Users should upgrade Apache NimBLE to version 1.10.0 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor advisory recommending upgrade to 1.10.0.