CVE-2026-45811: Apache NimBLE Buffer Overflow Vulnerability

CVE-2026-45811 Overview

CVE-2026-45811 is a classic buffer overflow [CWE-120] in Apache NimBLE, an open-source Bluetooth Low Energy stack maintained by the Apache Mynewt project. The Host Controller Interface (HCI) socket transport failed to validate whether incoming HCI events would fit within the configured event pool before copying them, enabling a buffer overflow condition. The flaw affects Apache NimBLE versions through 1.9.0 and is remediated in version 1.10.0.

Exploitation requires either a misconfigured event pool size or a malicious controller on the other end of the HCI socket link. It cannot be triggered over-the-air via Bluetooth radio.

Critical Impact
A compromised or malicious HCI controller can send oversized events to overflow the event buffer, potentially corrupting adjacent memory in the host process running the NimBLE stack.

Affected Products

Apache NimBLE versions through 1.9.0
Apache Mynewt deployments using the ble_hci_socket transport
Embedded and Linux-based BLE host applications built on NimBLE

Discovery Timeline

2026-07-24 - CVE-2026-45811 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-45811

Vulnerability Analysis

The vulnerability resides in nimble/transport/socket/src/ble_hci_socket.c, which implements the HCI socket transport between the NimBLE host and a Bluetooth controller reached over a Unix or TCP socket. When the transport receives an HCI event frame, it allocates an event buffer from a fixed-size pool defined by BLE_TRANSPORT_EVT_SIZE and copies the payload without comparing the incoming length to the pool capacity.

A controller-side peer that supplies an event length larger than BLE_TRANSPORT_EVT_SIZE triggers a linear write past the end of the allocated buffer. The resulting corruption can affect adjacent heap metadata or neighboring allocations depending on the allocator in use, leading to memory corruption, process crashes, or, in constrained conditions, control-flow influence.

Root Cause

The root cause is a missing length check between the received HCI event length field and the compile-time event pool size. NimBLE trusted the peer controller to send events sized within the configured pool, so no bounds validation guarded the subsequent copy into a freshly allocated event buffer.

Attack Vector

The attack surface is the HCI socket transport link, not the Bluetooth radio interface. An attacker must control or compromise the process or device acting as the HCI controller peer, or the deployment must be misconfigured with an unusually small event pool. Once positioned, the attacker sends a crafted HCI event whose declared length exceeds BLE_TRANSPORT_EVT_SIZE to trigger the overflow.

// Patch from ble_hci_socket.c - reject oversized HCI events
            }
            STATS_INC(hci_sock_stats, imsg);
            STATS_INC(hci_sock_stats, ievt);
+
+            /* There isn't much we can do if received event is too big */
+            if (len - 1 > MYNEWT_VAL(BLE_TRANSPORT_EVT_SIZE)) {
+                STATS_INC(hci_sock_stats, ierr);
+                dprintf(1, "Too big HCI event (%d > %d), ignoring\n", len - 1,
+                        MYNEWT_VAL(BLE_TRANSPORT_EVT_SIZE));
+                return -1;
+            }
+
            data = ble_transport_alloc_evt(0);
            if (!data) {
                STATS_INC(hci_sock_stats, ierr);

Source: Apache mynewt-nimble commit dcc4e4f. The fix adds an explicit length check that discards HCI events exceeding the configured event pool size and increments the error counter.

Detection Methods for CVE-2026-45811

Indicators of Compromise

Increments to the hci_sock_stats.ierr counter alongside unexpected HCI socket disconnects
Log entries containing Too big HCI event from patched builds, indicating rejected oversized frames
Unexpected NimBLE host process crashes or segmentation faults tied to HCI event handling

Detection Strategies

Inventory embedded and Linux-based BLE deployments and identify binaries linking Apache NimBLE at or below version 1.9.0
Inspect build configurations for non-default BLE_TRANSPORT_EVT_SIZE values that may shrink the event pool below controller-emitted event sizes
Monitor HCI socket peers for untrusted endpoints, especially where the controller runs in a separate container, VM, or remote host

Monitoring Recommendations

Forward NimBLE stack logs and crash telemetry to a centralized logging pipeline for correlation
Alert on repeated malformed HCI event errors, which can indicate probing of the transport boundary
Track process integrity of NimBLE host applications and investigate unexpected restarts on affected versions

How to Mitigate CVE-2026-45811

Immediate Actions Required

Upgrade Apache NimBLE to version 1.10.0 or later, which contains the length validation fix in ble_hci_socket.c
Audit all HCI socket peers and restrict the transport link to trusted, authenticated controllers only
Review BLE_TRANSPORT_EVT_SIZE settings against the maximum event sizes the paired controller can emit

Patch Information

The fix is committed as dcc4e4f026109eecd507de9479bb5019306a4a41 in the apache/mynewt-nimble repository and shipped in Apache NimBLE 1.10.0. The patch adds a size check before allocating and copying into the event buffer, dropping any HCI event whose payload exceeds MYNEWT_VAL(BLE_TRANSPORT_EVT_SIZE). See the Apache mailing list announcement and the Openwall oss-security post for details.

Workarounds

Constrain the HCI socket to a local, trusted controller process and block external network exposure of the socket
Increase BLE_TRANSPORT_EVT_SIZE in the build configuration to accommodate the largest legitimate HCI event the controller can emit
Apply the upstream patch as a backport where upgrading to 1.10.0 is not immediately feasible

bash

# Verify installed NimBLE version and rebuild against 1.10.0
git -C mynewt-nimble fetch --tags
git -C mynewt-nimble checkout nimble_1_10_0_tag
newt upgrade
newt build <target>