Apache NimBLE versions prior to 1.10.0 contain a vulnerability in the BASS service where improper validation of "Add Source" and "Modify Source" operation PDUs can cause an integer underflow leading to an out-of-bounds write (CWE-787) and stack buffer overflow. This flaw can be triggered by nearby devices over Bluetooth after pairing, potentially allowing an attacker to execute arbitrary code or cause denial of service. The vulnerability is tracked as CVE-2026-45813 with a CVSS 3.1 base score of 8.8 (Attack Vector: Adjacent, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, Confidentiality/Integrity/Availability: High).

Successful exploitation can result in arbitrary code execution, stack buffer overflow, and denial of service on affected devices running Apache NimBLE versions before 1.10.0. The attack requires Bluetooth proximity and prior pairing, which may limit exposure depending on device pairing policies. The confidentiality, integrity, and availability of the affected system can be fully compromised.

Users should upgrade Apache NimBLE to version 1.10.0 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor advisory recommending upgrade to 1.10.0. There is no indication that the vulnerability is mitigated by configuration or that no action is required.