CVE-2026-45812
Received Received - Intake

Buffer Size Miscalculation in Apache NimBLE

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Apache Software Foundation

Description
Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the buffer and deliver a GAP event with bogus data to the application. Severity is low: NimBLE's own controller never batches multiple reports into one event, so this only matters when NimBLE's host is paired with a third-party controller that does. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-45812
EUVD
EUVD-2026-48585

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache nimble to 1.9.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Incorrect Calculation of Buffer Size issue in Apache NimBLE when processing Legacy Advertising Report HCI events. When a single HCI advertising report event contains multiple reports, NimBLE miscalculates the offset to the next report. This causes the host to read past the end of the buffer, potentially delivering a GAP event with corrupted data to the application.

Detection Guidance

This vulnerability is specific to Apache NimBLE versions before 1.10.0 when paired with third-party Bluetooth controllers that batch multiple advertising reports into a single HCI event. Detection requires checking the NimBLE version in use. Commands like 'nimble version' or examining installed packages may help identify if an outdated version is running.

Impact Analysis

The impact is limited because NimBLE's own controller never batches multiple reports into one event. This issue only affects users pairing NimBLE's host with a third-party controller that does batch reports. Potential impacts include receiving invalid data in Bluetooth GAP events, which could disrupt Bluetooth communication or cause application errors.

Compliance Impact

This vulnerability involves incorrect buffer size calculation in Apache NimBLE when processing HCI advertising reports. It may lead to memory corruption or invalid data exposure if paired with a third-party controller. While not directly tied to GDPR or HIPAA, such memory issues could potentially risk data integrity or confidentiality if exploited, though the severity is low and requires specific conditions.

Mitigation Strategies

Upgrade Apache NimBLE to version 1.10.0 or later, which fixes the buffer size calculation issue. This is the primary mitigation step recommended by the Apache Security team.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45812. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart