CVE-2025-53477highCWE-476

CVE-2025-53477: high-severity vulnerability in Apache Mynewt NimBLE

Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer

Published · Updated

Follow this CVE+ Monitor Apache Mynewt NimBLE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.8%
NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Apache Software Foundation · Apache Mynewt NimBLE
Related CVEs — Apache Mynewt NimBLE

In the same product, most dangerous first.

CVE-2025-62235HIGHApache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairingEPSS 0.4%CVE-2025-53470LOWApache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driverEPSS 0.3%CVE-2025-52435HIGHApache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controllerEPSS 0.2%