CVE-2026-47773

Received Received - Intake

Memory Corruption in ArduinoBLE via BLE Write Request

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected. The fix is included starting from the 2.0.2 release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-47773

Affected Vendors & Products

Vendor	Product	Version / Range
arduino	arduinoble	to 2.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

Executive Summary

ArduinoBLE versions before 2.0.2 have a missing bounds check in the ATT layer write request handler. This allows unauthenticated BLE clients to corrupt memory in the ATTClass global object. Only devices with characteristics configured with the BLEEncryption property are affected.

Detection Guidance

Detecting this vulnerability requires checking the ArduinoBLE library version on affected devices. Use commands like 'pip show arduino-ble' or inspect the library files in your Arduino project directory for versions prior to 2.0.2.

Impact Analysis

A remote attacker could exploit this to corrupt memory, potentially causing crashes, unexpected behavior, or unauthorized access to device functions. This could disrupt operations if the device relies on BLE for critical tasks.

Compliance Impact

This vulnerability allows memory corruption via unauthenticated BLE clients, which could lead to unauthorized data access or manipulation. For GDPR, this may violate principles of data integrity and confidentiality. For HIPAA, it could compromise protected health information integrity if exploited.

Mitigation Strategies

Upgrade ArduinoBLE to version 2.0.2 or later. If upgrading is not possible, remove or disable characteristics configured with the BLEEncryption property to reduce exposure.

Hi! I’m here to help you understand CVE-2026-47773. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70