CVE-2026-45816: high-severity vulnerability in Apache NimBLE
Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 1.0%
NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event.
This requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Apache Software Foundation · Apache NimBLERelated CVEs — Apache NimBLE
In the same product, most dangerous first.
CVE-2024-24746HIGHApache NimBLE: Denial of service in NimBLE Bluetooth stackEPSS 1.4%CVE-2024-51569HIGHApache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handlerEPSS 1.2%CVE-2026-45815HIGHApache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handlerEPSS 1.0%CVE-2026-46452MEDIUMApache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failureEPSS 0.9%CVE-2024-47248MEDIUMApache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stackEPSS 0.7%CVE-2026-45812MEDIUMApache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report HandlerEPSS 0.7%