EUVD-2026-48585
GHSA-m9xh-wpcw-qvx9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event.
When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the buffer and deliver a GAP event with bogus data to the application.
Severity is low: NimBLE's own controller never batches multiple reports into one event, so this only matters when NimBLE's host is paired with a third-party controller that does.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
AnalysisAI
Apache NimBLE 1.9.0 and earlier mishandles multi-report HCI advertising events, potentially leaking heap memory when used with certain third-party Bluetooth controllers. The vulnerability is not under active exploitation and no public exploit code exists.
More in Apache Nimble
View allMemory corruption in Apache NimBLE BASS service allows a nearby, paired attacker to exploit an integer underflow during
Denial of service in Apache NimBLE 1.9.0 and earlier allows a remote attacker to crash the BLE host stack via a crafted
A denial-of-service vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly can be exploited by remote attackers with
Denial-of-service in Apache NimBLE up to version 1.9.0 allows remote attackers to crash the BLE host by causing a NULL p
Buffer overflow in Apache NimBLE's HCI socket transport (through version 1.9.0) allows an adjacent attacker with a malic
Same weakness CWE-131 – Incorrect Calculation of Buffer Size
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today