EUVD-2026-48586
GHSA-2vqf-9746-8h23
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read.
This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, which depending on device configuration may or may not require user action.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
AnalysisAI
Memory corruption in Apache NimBLE BASS service allows a nearby, paired attacker to exploit an integer underflow during parsing of Add Source or Modify Source PDUs, leading to a stack buffer overflow or arbitrary out-of-bounds read. This can result in full device compromise. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability, but a vendor patch is available.
More in Apache Nimble
View allDenial of service in Apache NimBLE 1.9.0 and earlier allows a remote attacker to crash the BLE host stack via a crafted
Apache NimBLE 1.9.0 and earlier mishandles multi-report HCI advertising events, potentially leaking heap memory when use
A denial-of-service vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly can be exploited by remote attackers with
Denial-of-service in Apache NimBLE up to version 1.9.0 allows remote attackers to crash the BLE host by causing a NULL p
Buffer overflow in Apache NimBLE's HCI socket transport (through version 1.9.0) allows an adjacent attacker with a malic
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today