Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE.
The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either a misconfigured pool size or a malicious/compromised controller on the other end of the HCI socket link, not over-the-air Bluetooth access.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/apache/mynewt-nimble/commit/dcc4e4f026109eecd507de9479bb5019306a4a41 | Patch |
| https://lists.apache.org/thread/5mkz68y1py0o6zmxtc3l1o8grtrb78m0 | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/07/24/11 | Mailing List Third Party Advisory |
Configurations
History
27 Jul 2026, 14:41
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache
Apache nimble |
|
| CPE | cpe:2.3:a:apache:nimble:*:*:*:*:*:*:*:* | |
| References | () https://github.com/apache/mynewt-nimble/commit/dcc4e4f026109eecd507de9479bb5019306a4a41 - Patch | |
| References | () https://lists.apache.org/thread/5mkz68y1py0o6zmxtc3l1o8grtrb78m0 - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/07/24/11 - Mailing List, Third Party Advisory |
24 Jul 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
24 Jul 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Jul 2026, 13:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-24 13:18
Updated : 2026-07-27 14:41
NVD link : CVE-2026-45811
Mitre link : CVE-2026-45811
CVE.ORG link : CVE-2026-45811
JSON object : View
Products Affected
apache
- nimble
CWE
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')