CVE-2026-45813: Apache Nimble Buffer Overflow Vulnerability

CVE-2026-45813 Overview

CVE-2026-45813 is an out-of-bounds write and integer underflow vulnerability in the Apache NimBLE Broadcast Audio Scan Service (BASS). The flaw stems from improper validation when parsing BASS service Add Source and Modify Source operation Protocol Data Units (PDUs). An attacker within Bluetooth range can trigger a stack buffer overflow or arbitrary out-of-bounds read against a paired peer. The vulnerability affects Apache NimBLE through version 1.9.0 and is fixed in 1.10.0. Pairing is required before accessing the BASS service, though depending on device configuration this may not require user interaction.

Critical Impact
Adjacent-network attackers can corrupt stack memory on BLE-enabled devices running Apache NimBLE, potentially achieving arbitrary code execution on embedded and IoT targets.

Affected Products

Apache NimBLE versions up to and including 1.9.0
Apache Mynewt-based firmware and embedded systems using NimBLE for Bluetooth Low Energy connectivity
IoT devices, wearables, and audio products implementing the BASS (Broadcast Audio Scan Service) profile

Discovery Timeline

2026-07-24 - CVE-2026-45813 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-45813

Vulnerability Analysis

Apache NimBLE is a Bluetooth Low Energy (BLE) stack used in embedded and IoT firmware, including the Apache Mynewt operating system. The Broadcast Audio Scan Service (BASS) allows a BLE central device to inform peripherals about available broadcast audio streams. Two BASS operations, Add Source and Modify Source, accept variable-length PDU fields describing broadcast metadata and subgroup information.

The vulnerability arises because length fields inside these PDUs are not properly validated before being used in size calculations and memory copies. An adversary who is paired with the target can send a malformed PDU that triggers an integer underflow, which then feeds a stack-based buffer copy operation. The resulting out-of-bounds write corrupts adjacent stack memory, and a related code path also permits an arbitrary out-of-bounds read.

Successful exploitation can compromise the confidentiality, integrity, and availability of the target device. On embedded systems without robust stack protection, this can lead to code execution in the BLE host context.

Root Cause

The root cause is an integer underflow [CWE-191] during BASS PDU parsing. When the parser subtracts a header size from a smaller attacker-controlled length value, the result wraps around into a large unsigned integer. This inflated value is then passed as a length parameter to a stack-resident buffer, causing a linear stack buffer overflow. See the Apache NimBLE pull request 2232 for the corrective validation logic.

Attack Vector

The attack requires Bluetooth adjacency and a prior pairing relationship with the target. Once paired, the attacker writes crafted Add Source or Modify Source PDUs to the BASS characteristic. No user interaction is required at exploitation time, though pairing behavior depends on the device's I/O capabilities and Just Works or numeric-comparison configuration. Because BLE pairing on many IoT devices uses Just Works pairing without meaningful authentication, the effective barrier to exploitation is low.

The vulnerability is described in prose only; no public proof-of-concept has been released. Refer to the Apache mailing list disclosure and the Openwall OSS Security post for technical details.

Detection Methods for CVE-2026-45813

Indicators of Compromise

Unexpected crashes, watchdog resets, or hard faults on BLE peripherals shortly after a paired peer interacts with the BASS service
Anomalous BASS Add Source (opcode 0x02) or Modify Source (opcode 0x03) writes containing oversized or inconsistent subgroup length fields
New or unfamiliar paired devices appearing in the bonding database of BLE peripherals

Detection Strategies

Instrument BLE peripherals with stack canary and MPU fault logging to capture overflow attempts against the NimBLE host task
Inspect firmware update inventories to identify devices still shipping NimBLE 1.9.0 or earlier
Where a BLE sniffer is available in test environments, capture GATT writes to BASS characteristics and validate length fields against the specification

Monitoring Recommendations

Track firmware versions of NimBLE-based products through asset inventory and Software Bill of Materials (SBOM) data
Alert on repeated BLE pairing attempts or bond-list changes reported by device telemetry
Correlate device crash telemetry with proximity events from mobile device management (MDM) platforms that track nearby Bluetooth peers

How to Mitigate CVE-2026-45813

Immediate Actions Required

Upgrade Apache NimBLE to version 1.10.0 or later across all affected firmware images
Rebuild and redeploy any downstream product firmware that statically links a vulnerable NimBLE version
Audit BLE pairing policies and disable Just Works pairing where higher-assurance authentication is feasible

Patch Information

Apache has released Apache NimBLE 1.10.0, which adds proper length validation to the BASS Add Source and Modify Source PDU parsers. The fix is available through the upstream mynewt-nimble pull request 2232. Product vendors should integrate the update, rebuild firmware, and issue signed over-the-air updates to fielded devices.

Workarounds

Disable the BASS service in firmware builds where broadcast audio scanning is not required
Restrict which peers are permitted to pair with the device, using out-of-band or numeric-comparison pairing to raise the bar for adjacent attackers
Clear existing bonding tables on high-value devices and re-pair only with trusted peers until patched firmware is deployed

bash

# Verify the linked NimBLE version in a Mynewt project
newt info | grep -i nimble

# Update to the fixed release
newt upgrade apache-mynewt-nimble@1.10.0
newt build <target>
newt create-image <target> <version> <signing-key>