CVE-2026-45815: high-severity vulnerability in Apache NimBLE
Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 1.0%
Reachable Assertion vulnerability in Apache NimBLE.
A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser.
Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Apache Software Foundation · Apache NimBLERelated CVEs — Apache NimBLE
In the same product, most dangerous first.
CVE-2024-24746HIGHApache NimBLE: Denial of service in NimBLE Bluetooth stackEPSS 1.4%CVE-2024-51569HIGHApache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handlerEPSS 1.2%CVE-2026-45816HIGHApache NimBLE: NULL pointer dereference vulnerability in SMP LTK requestEPSS 1.0%CVE-2026-46452MEDIUMApache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failureEPSS 0.9%CVE-2024-47248MEDIUMApache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stackEPSS 0.7%CVE-2026-45812MEDIUMApache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report HandlerEPSS 0.7%