CVE-2026-45811 in NimBLE
Summary
by MITRE • 07/24/2026
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either a misconfigured pool size or a malicious/compromised controller on the other end of the HCI socket link, not over-the-air Bluetooth access.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability under discussion represents a classic buffer overflow condition within the Apache NimBLE Bluetooth stack implementation, specifically impacting the HCI socket transport layer. This flaw resides in the fundamental data handling mechanism where incoming HCI events are processed without proper bounds checking against the allocated buffer space. The vulnerability manifests when the system attempts to copy received HCI events into a pre-allocated event pool without verifying whether the incoming data exceeds the configured pool size limitations.
From a technical perspective, this buffer overflow occurs at the transport layer of the Bluetooth stack where socket-based communication handles HCI (Host Controller Interface) events between the host and controller components. The flaw stems from inadequate input validation mechanisms that should have enforced size constraints before memory copying operations. When an HCI event arrives that surpasses the predetermined buffer boundaries, the copy operation overwrites adjacent memory locations, potentially leading to unpredictable system behavior including crashes or memory corruption. This type of vulnerability maps directly to CWE-121, which describes classic buffer overflow conditions where insufficient bounds checking allows data to overwrite adjacent memory regions.
The operational impact of this vulnerability remains relatively constrained due to its specific exploitation requirements. According to the advisory, successful exploitation necessitates either a misconfigured pool size within the system configuration or the presence of a malicious/compromised Bluetooth controller on the opposite end of the HCI socket connection. This requirement significantly limits the attack surface since it eliminates direct over-the-air Bluetooth exploitation possibilities, making the vulnerability more relevant in controlled environments where physical access or network compromise is already present. The low severity classification reflects these operational constraints that prevent widespread remote exploitation.
Security practitioners should recognize this vulnerability through the lens of ATT&CK framework category TA0043, which addresses privilege escalation and defense evasion techniques. While the immediate impact may be limited, the buffer overflow condition creates potential entry points for more sophisticated attacks that could leverage memory corruption to achieve arbitrary code execution or system compromise. The mitigation strategy focuses on upgrading to Apache NimBLE version 1.10.0, which implements proper bounds checking mechanisms in the HCI socket transport layer. This upgrade addresses the root cause by ensuring that incoming HCI events are validated against pool size limitations before any memory copying operations occur.
The broader implications extend beyond this specific vulnerability to highlight the critical importance of input validation and bounds checking in embedded systems and network protocols. Bluetooth stack implementations require rigorous testing of buffer management procedures, particularly in environments where external entities might influence data flow through socket connections. Organizations utilizing Apache NimBLE should conduct thorough security assessments of their configurations to ensure proper pool sizing and implement monitoring mechanisms to detect potential exploitation attempts. The vulnerability serves as a reminder that even seemingly low-severity issues can represent significant risks when combined with other system weaknesses or compromised network conditions.