Which versions of SimpleBLE are affected by CVE-2026-44634?

SimpleBLE, a widely-used Bluetooth library, contains remote code execution vulnerabilities (CVSS 8.7) exploitable without authentication from any attacker within Bluetooth range.

How to fix or mitigate CVE-2026-44634?

24 hours: Identify all applications and firmware using SimpleBLE library and their deployment scope. 7 days: Assess whether vulnerable systems operate in environments with untrusted Bluetooth access; contact SimpleBLE maintainers for patched release timeline; begin testing upgrade paths. 30 days: Deploy SimpleBLE version 0.14.0 or later across all affected applications and devices.

SimpleBLE CVE-2026-44634

Q: What is the CVSS score of CVE-2026-44634?

CVE-2026-44634 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 GitHub_M

Buffer Overflow Stack Overflow Simpleble

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 10, 2026 - 03:00 vuln.today

Analysis Generated

Jun 10, 2026 - 03:00 vuln.today

CVSS changed

Jun 10, 2026 - 01:22 NVD

8.7 (HIGH)

CVE Published

Jun 09, 2026 - 23:59 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

SimpleBLE is a cross-platform library and bindings for Bluetooth Low Energy (BLE). Prior to version 0.14.0, there are multiple stack-based buffer overflow vulnerabilities in SimpleBLE. There is a stack overflow vulnerability in the dongl backend’s Protocol::simpleble_write function (local, caller-controlled input). A stack overflow vulnerability when processing manufacturer-specific data in BLE advertisements (remote, no pairing or connection required). Lastly, a stack overflow vulnerability when processing service data in BLE advertisements (remote, no pairing or connection required). This issue has been patched in version 0.14.0.

AnalysisAI

Stack-based buffer overflows in SimpleBLE prior to version 0.14.0 allow remote attackers within Bluetooth range to crash applications by transmitting crafted BLE advertisements containing oversized manufacturer-specific data or service data, requiring no pairing or connection. A separate local overflow exists in the dongl backend's Protocol::simpleble_write function via caller-controlled input. No public exploit identified at time of analysis, but the patch diff and acknowledgement to researcher Mr-IoT confirm three tracked issues (EVE-2026-001/002/003).

Technical ContextAI

SimpleBLE is a cross-platform C++ library providing Bluetooth Low Energy (BLE) APIs and language bindings used to build host-side BLE applications. The vulnerabilities are CWE-121 (Stack-Based Buffer Overflow) issues rooted in unchecked size handling: the SimpleCBLE advertisement parser copied manufacturer-specific and service data into fixed-size stack buffers sized for legacy BLE 4.x 31-byte advertisements, but BLE 5.0 extended advertisements can carry significantly larger payloads (the patch adds a comment acknowledging this and truncates input). Separately, the dongl serial backend's Protocol::simpleble_write accepted arbitrary-length payloads without validating against the 512-byte simpleble_WriteCmd_data_t::bytes field; the fix introduces a length_error throw when input exceeds 512 bytes.

RemediationAI

Upgrade to SimpleBLE 0.14.0 or later, which adds bounds validation in Protocol::simpleble_write (throws std::length_error when payload exceeds 512 bytes) and truncates oversized manufacturer/service data in the SimpleCBLE advertisement parser; the fix commit is 1501d59d76a4280268372afb1b157bf6caeacba6 and PR https://github.com/simpleble/simpleble/pull/466. Downstream applications must rebuild and redistribute against the patched library - there is no runtime configuration toggle. As an interim compensating control for environments that cannot rebuild immediately, stop active BLE scanning on untrusted RF environments (disable startScan or restrict to known-quiet RF zones), which eliminates the remote advertisement-parsing exposure at the cost of losing device discovery functionality; for the dongl local bug, audit any callers passing externally-derived data to simpleble_write and impose a 512-byte size check at the call site.