CVE-2026-45812: Apache Nimble Buffer Overflow Vulnerability

CVE-2026-45812 Overview

CVE-2026-45812 is an Incorrect Calculation of Buffer Size vulnerability [CWE-131] in Apache NimBLE, an open-source Bluetooth Low Energy (BLE) stack maintained by the Apache Software Foundation. The flaw resides in the host-side parser for the Legacy Advertising Report Host Controller Interface (HCI) event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculates the offset to the next report and reads past the end of the buffer. The host then delivers a Generic Access Profile (GAP) event containing bogus data to the application. All Apache NimBLE releases up to and including 1.9.0 are affected.

Critical Impact
The vulnerability causes out-of-bounds memory reads that surface as corrupted GAP event data in applications relying on NimBLE for BLE scanning.

Affected Products

Apache NimBLE versions up to and including 1.9.0
Apache Mynewt deployments bundling vulnerable NimBLE host code
Embedded and IoT devices pairing the NimBLE host with third-party BLE controllers that batch multiple advertising reports per HCI event

Discovery Timeline

2026-07-24 - CVE-2026-45812 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-45812

Vulnerability Analysis

The defect lives in nimble/host/src/ble_hs_hci_evt.c, which decodes HCI Legacy Advertising Report events sent from the BLE controller to the host. Each event may carry one or more advertising reports of variable length, with data_len describing the payload of an individual report. The host walks the buffer by advancing a pointer past each parsed report. The size calculation used for that pointer advance is wrong, so the pointer lands at the wrong offset for subsequent reports. Downstream parsing then reads adjacent memory as if it were the next ble_hci_ev_le_subev_adv_rpt structure and forwards the malformed contents to registered GAP callbacks.

Root Cause

The parser advanced the working pointer by sizeof(rpt) instead of sizeof(*rpt). Because rpt is a pointer, sizeof(rpt) returns the size of the pointer itself (typically 4 or 8 bytes) rather than the size of the underlying report structure. This classic misuse of the sizeof operator collapses the stride between reports to a pointer width, guaranteeing that every report after the first is parsed at an incorrect offset that runs off the end of the received HCI buffer.

Attack Vector

Exploitation requires the NimBLE host to be paired with a third-party BLE controller that packs multiple advertising reports into a single HCI Legacy Advertising Report event. NimBLE's own controller never batches reports, so stacks running the reference controller are not affected in practice. When a malicious or nonconforming peer transmits crafted advertising packets that the third-party controller aggregates, the host reads uninitialized or attacker-adjacent memory and passes it to the application as GAP event data. The impact is scoped to information exposure and application-level logic errors, not remote code execution.

     for (i = 0; i < ev->num_reports; i++) {
         rpt = data;
 
-        data += sizeof(rpt) + rpt->data_len + 1;
+        data += sizeof(*rpt) + rpt->data_len + 1;
 
         desc.event_type = rpt->type;
         desc.addr.type = rpt->addr_type;
// Source: https://github.com/apache/mynewt-nimble/commit/605c7585408bc3674818eeb7b6f478a8aefe9746

The patch replaces sizeof(rpt) with sizeof(*rpt), restoring the correct stride equal to the size of the advertising report header structure.

Detection Methods for CVE-2026-45812

Indicators of Compromise

Applications built on NimBLE reporting garbled advertising data, invalid BLE addresses, or nonsensical event_type fields during scanning
Sporadic memory faults or watchdog resets on embedded devices during BLE discovery when connected to a third-party controller
HCI traces showing Legacy Advertising Report events with num_reports greater than 1

Detection Strategies

Enumerate firmware images and IoT inventory for NimBLE builds at or below version 1.9.0 using software bill of materials (SBOM) tooling
Inspect device firmware to confirm whether the NimBLE host is paired with the built-in NimBLE controller or a third-party BLE controller
Capture HCI logs during BLE scanning and look for multi-report Legacy Advertising Report events combined with downstream GAP anomalies

Monitoring Recommendations

Track upstream advisories from the Apache NimBLE project and the Apache Mailing List Thread for follow-up guidance
Instrument BLE scanning code paths to log and drop advertising reports with implausible data_len values or malformed address types
Correlate device crash telemetry with BLE activity windows to identify units impacted by out-of-bounds reads

How to Mitigate CVE-2026-45812

Immediate Actions Required

Upgrade Apache NimBLE to version 1.10.0, which contains the fix for the report offset calculation
Identify all embedded and IoT products shipping NimBLE 1.9.0 or earlier and prioritize firmware updates for devices paired with third-party BLE controllers
Backport the one-line fix from commit 605c758 if a full version upgrade is not immediately feasible

Patch Information

The Apache NimBLE maintainers released version 1.10.0 with the fix. The corrective change is contained in commit 605c7585408bc3674818eeb7b6f478a8aefe9746 in the apache/mynewt-nimble repository and is discussed in the Apache Mailing List Thread and the Openwall OSS Security Discussion.

Workarounds

Pair the NimBLE host exclusively with the reference NimBLE controller, which never batches multiple advertising reports into a single HCI event
Add a defensive check in application code to validate data_len and total buffer bounds before consuming GAP event data
Restrict BLE scanning to trusted environments until affected devices receive the patched firmware

bash

# Verify installed Apache NimBLE version in a Mynewt project
grep -R "MYNEWT_VAL_BLE_VERSION\|nimble.*1\." repos/apache-mynewt-nimble/

# Update NimBLE submodule to the fixed release
cd repos/apache-mynewt-nimble
git fetch --tags
git checkout nimble_1_10_0
newt build <target>