CVE-2026-45813 in NimBLE
Summary
by MITRE • 07/24/2026
Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read.
This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, which depending on device configuration may or may not require user action.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability under discussion represents a critical security flaw in Apache NimBLE's Bluetooth Audio Streaming Service (BASS) implementation that manifests as both out-of-bounds write conditions and integer underflow scenarios. This vulnerability resides within the BASS service's handling of "Add Source" and "Modify Source" operation Protocol Data Units, where improper input validation creates opportunities for malicious actors to exploit buffer boundaries through crafted Bluetooth packets. The technical flaw specifically involves the manipulation of integer values that, when processed without proper bounds checking, can result in memory corruption patterns that may manifest as stack buffer overflows or arbitrary out-of-bound memory reads. The vulnerability is classified under CWE-121 Stack-based Buffer Overflow and CWE-191 Integer Underflow (Wrap or Wraparound) within the Common Weakness Enumeration framework.
The operational impact of this vulnerability extends beyond simple denial-of-service conditions to potentially enable remote code execution or privilege escalation within affected systems. Attackers can exploit this flaw by establishing a Bluetooth connection with nearby devices and leveraging the pre-existing pairing requirements that vary based on device configuration settings. The attack vector requires proximity but does not necessitate complex authentication beyond the initial pairing process, making it particularly concerning for IoT devices and mobile platforms where Bluetooth interactions are frequent. According to ATT&CK framework categorization, this vulnerability maps to T1046 Network Service Scanning and T1210 Exploitation of Remote Services, as it enables attackers to manipulate remote Bluetooth services through properly formatted PDU sequences.
The memory corruption resulting from this vulnerability creates multiple potential attack surfaces within the target system's execution environment. When integer underflow occurs during parsing operations, the subsequent out-of-bounds write conditions can overwrite adjacent memory locations, potentially corrupting critical program state variables or even executable code segments. The stack-based buffer overflow aspect particularly threatens application stability and security boundaries, as it may allow attackers to manipulate return addresses or overwrite function parameters in ways that could facilitate privilege escalation. The affected Apache NimBLE versions through 1.9.0 represent a significant attack surface since this library is widely deployed in embedded systems, IoT devices, and mobile platforms where Bluetooth audio streaming capabilities are implemented.
The recommended mitigation strategy involves upgrading to Apache NimBLE version 1.10.0 which includes patched validation routines for PDU parsing operations. This upgrade addresses the core input validation deficiencies by implementing proper bounds checking mechanisms that prevent integer underflow conditions during BASS service operation processing. Organizations should prioritize this patch deployment across all affected systems, particularly those in high-risk environments where Bluetooth connectivity is prevalent and where the potential for exploitation could lead to unauthorized access or system compromise. The fix demonstrates proper defensive programming practices that align with industry standards for secure software development lifecycle requirements and emphasizes the importance of input validation in preventing memory corruption vulnerabilities.