CVE-2026-45815 is a reachable assertion vulnerability (CWE-617) in Apache NimBLE affecting versions before 1.10.0. A maliciously crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) can trigger an assertion failure in the ATT parser component. This requires the target device to initiate an ATT Read Multiple Variable Request, making exploitation conditional. The vulnerability has been addressed in Apache NimBLE version 1.10.0.

Successful exploitation may cause the ATT parser to hit an assertion failure, which could lead to application crashes or denial of service conditions on affected devices. Since exploitation requires a prior ATT Read Multiple Variable Request from the device, the attack surface is somewhat limited. There are no known exploits in the wild at this time.

Users should upgrade Apache NimBLE to version 1.10.0 or later, where this vulnerability is fixed. No other mitigations are explicitly stated. Patch status is confirmed by the vendor's recommendation to upgrade to 1.10.0.