CVE-2026-45812 in NimBLE
Summary
by MITRE • 07/24/2026
Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event.
When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the buffer and deliver a GAP event with bogus data to the application.
Severity is low: NimBLE's own controller never batches multiple reports into one event, so this only matters when NimBLE's host is paired with a third-party controller that does.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability under discussion represents an incorrect calculation of buffer size within Apache NimBLE's processing of Legacy Advertising Report HCI events, constituting a classic buffer overflow condition that could potentially lead to data corruption and unexpected application behavior. This flaw exists specifically within the host component of the NimBLE stack when handling HCI advertising report events that contain multiple reports in a single packet structure.
The technical implementation flaw occurs when NimBLE processes an HCI advertising report event that bundles multiple individual advertising reports into one transmission. The host component incorrectly calculates the memory offset to locate the beginning of the next advertising report within the buffer, leading to improper boundary calculations. This miscalculation results in the host reading beyond the allocated buffer boundaries and subsequently delivering malformed GAP events containing corrupted data to the application layer.
From an operational perspective, this vulnerability demonstrates a typical case of insufficient input validation and memory management in embedded Bluetooth stack implementations. The flaw's impact is mitigated by the fact that NimBLE's own controller does not batch multiple reports into single events, meaning the vulnerability only manifests when third-party controllers are used in conjunction with NimBLE's host component. This limitation reduces the attack surface significantly but does not eliminate the risk entirely.
The vulnerability can be classified under CWE-129 Input Validation and OWASP Top Ten category A03: Injection, as it involves improper handling of boundary conditions in data processing. From an ATT&CK framework perspective, this represents a software integrity issue that could potentially lead to privilege escalation or information disclosure if exploited by adversaries controlling the third-party controller component.
The security implications extend beyond immediate data corruption, as applications receiving malformed GAP events may behave unpredictably or fail to properly handle advertising data, potentially leading to service disruption or security policy violations. The low severity classification reflects that the vulnerability requires specific conditions to be exploited - namely the use of a third-party controller that batches reports - but it still represents a legitimate concern for systems requiring robust Bluetooth connectivity.
Mitigation strategies should focus on upgrading to Apache NimBLE version 1.10.0, which contains the necessary fixes for proper buffer size calculation and offset handling. Organizations using NimBLE in production environments should also implement monitoring for unusual advertising report patterns and consider additional input validation at application layers that process GAP events. The fix addresses the root cause by implementing correct buffer boundary calculations and ensuring proper memory management when processing multiple advertising reports within single HCI events.
This vulnerability highlights the importance of thorough testing in Bluetooth stack implementations, particularly around edge cases involving data aggregation and buffer management. It serves as a reminder that even seemingly minor calculation errors in embedded systems can have significant implications for system stability and security, especially when dealing with wireless communication protocols where timing and data integrity are critical factors.