BitChat iOS EUVD-2026-67916

Exploitation requires physical Bluetooth adjacency - the attacker must be within BLE radio range (approximately 10-100m, hardware-dependent) of a device running BitChat for iOS v1.5.0. No authentication, device pairing, or prior relationship with the target is required (PR:N confirmed by CVSS vector). The BLE mesh feature must be active, which is BitChat's default operating mode. No special target-side configuration is needed. Exploitation is bounded by Bluetooth radio range and requires the ability to craft raw BLE packets with specific TTL=0 field values; standard BLE tooling (e.g., nRF Sniffer, custom firmware) is sufficient. The public PoC lowers the skill threshold for exploitation.

CVSS 6.5 with AV:A correctly constrains exploitation to Bluetooth adjacency - typically 10-100m - which significantly limits the attack surface compared to network-layer vulnerabilities and makes mass opportunistic exploitation unlikely. EPSS at 0.22% (13th percentile) reflects very low observed exploitation probability despite a public PoC existing, consistent with the app's niche user base of privacy-focused and activist communicators. No KEV listing confirms no known widespread active exploitation. The primary risk is localized disruption: an attacker must be physically co-located with victims running BitChat, making this a targeted rather than broad threat. The zero-authentication exploitation path and public PoC mean patching should not be deferred in any active deployment, but the overall enterprise risk surface is minimal given the app's limited footprint.

An attacker positions themselves within Bluetooth range of one or more BitChat iOS v1.5.0 users and transmits crafted BLE MESSAGE packets bearing TTL=0, which the app's validatePacket() function accepts unconditionally as anonymous messages, bypassing timestamp and sender checks. Repeated injection floods the mesh gossip cache, disrupting mesh availability for all nearby participants. A public proof-of-concept hosted at github.com/BARGHEST-ngo/PoC_Bitchat1.15.0_iOS-BLEcache-poisoning demonstrates this technique.