CVE-2026-45815 Overview
CVE-2026-45815 is a reachable assertion vulnerability in Apache NimBLE, an open source Bluetooth Low Energy (BLE) stack widely deployed in embedded and IoT devices. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) can trigger an assertion in the ATT parser, causing the target device to abort. Exploitation requires the Device Under Test (DUT) to first send an ATT Read Multiple Variable Request, which reduces the attack surface. The issue affects Apache NimBLE through version 1.9.0 and is fixed in version 1.10.0. The weakness is tracked as [CWE-617] (Reachable Assertion).
Critical Impact
A remote attacker within BLE range can crash affected devices by responding to a legitimate Read Multiple Variable Request with a malformed response packet.
Affected Products
- Apache NimBLE versions up to and including 1.9.0
- Embedded and IoT devices integrating the Apache Mynewt NimBLE host stack
- Products built on Apache Mynewt that use the NimBLE GATT client
Discovery Timeline
- 2026-07-24 - CVE-2026-45815 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-45815
Vulnerability Analysis
The vulnerability resides in the NimBLE GATT client code that parses ATT Read Multiple Variable responses. When the client processes a response, it invokes os_mbuf_pullup() on the incoming mbuf and then calls assert(*om) on the result. A malformed or truncated response returns NULL from the pullup operation, which triggers the assertion and aborts execution. The parser also fails to properly bound the loop against the actual packet length before consuming attribute data. Because the ATT layer is exposed over the BLE link, any peer that receives a Read Multiple Variable Request from the DUT can craft a response that reaches the vulnerable code path. The result is a denial-of-service condition on the BLE-enabled device.
Root Cause
The root cause is improper input validation combined with the use of assert() on attacker-influenced data. The pre-patch code assumed non-NULL pullup results and did not verify that at least two bytes of attribute-length data remained available before iterating over each handle. Using assert() for runtime error handling on network-derived input converts a recoverable parse error into a hard fault [CWE-617].
Attack Vector
Exploitation requires a paired or connected BLE peer. Once the DUT issues an ATT Read Multiple Variable Request, the attacker replies with a crafted BLE_ATT_OP_READ_MULT_VAR_RSP containing an empty or malformed payload. The assertion fires inside ble_gattc.c, terminating the BLE host task or the entire device firmware depending on the platform's assertion handler.
for (i = 0; i < proc->read_mult.num_handles; i++) {
attr[i].handle = proc->read_mult.handles[i];
attr[i].offset = 0;
- if (om == NULL || OS_MBUF_PKTLEN(*om) == 0) {
- continue;
- }
+ }
- *om = os_mbuf_pullup(*om, 2);
- assert(*om);
+ if (status == 0) {
+ for (i = 0; i < proc->read_mult.num_handles; i++) {
+ if (OS_MBUF_PKTLEN(*om) < 2) {
+ break;
+ }
- attr_len = get_le16((*om)->om_data);
+ *om = os_mbuf_pullup(*om, 2);
+ if (*om == NULL) {
+ break;
+ }
- os_mbuf_adj(*om, 2);
+ attr_len = get_le16((*om)->om_data);
+ os_mbuf_adj(*om, 2);
- if (attr_len > BLE_ATT_ATTR_MAX_LEN) {
- /*TODO Figure out what to do here */
- break;
- }
Source: Apache Mynewt NimBLE Patch Commit. The patch replaces the assert(*om) call with a graceful break, adds a length check before pullup, and restructures the loop to only execute when the transaction status is successful.
Detection Methods for CVE-2026-45815
Indicators of Compromise
- Unexpected reboots or firmware crashes on BLE devices immediately after GATT Read Multiple Variable operations
- Assertion failure log entries referencing ble_gattc.c or os_mbuf_pullup
- BLE peers sending zero-length or truncated BLE_ATT_OP_READ_MULT_VAR_RSP (opcode 0x21) packets
Detection Strategies
- Inspect BLE traffic captures for BLE_ATT_OP_READ_MULT_VAR_RSP responses with payloads shorter than two bytes
- Correlate device crash telemetry with recent GATT client transactions initiated by the DUT
- Monitor NimBLE host logs for repeated assertion aborts tied to the ATT parser
Monitoring Recommendations
- Aggregate embedded device crash reports and watchdog resets into a central log platform to spot patterns
- Track firmware versions across BLE fleet inventory to identify assets still running NimBLE 1.9.0 or earlier
- Alert on abnormal BLE disconnect rates that could indicate active exploitation attempts
How to Mitigate CVE-2026-45815
Immediate Actions Required
- Upgrade Apache NimBLE to version 1.10.0 or later on all affected devices
- Identify firmware images and vendor SDKs that bundle the Mynewt NimBLE host and coordinate downstream updates
- Restrict BLE pairing to trusted peers where operationally feasible
Patch Information
The fix is delivered in Apache NimBLE 1.10.0. The upstream commit fae6a48 refactors the GATT Read Multiple Variable response handler in nimble/host/src/ble_gattc.c to remove the assert() on attacker-controlled data and to validate remaining packet length before each attribute is parsed. Full technical context is available in the Apache Mailing List Discussion and the Openwall OSS-Security Post.
Workarounds
- Disable GATT client functionality that issues Read Multiple Variable Requests when patching is not immediately possible
- Limit BLE connectivity to bonded, authenticated peers to reduce exposure from opportunistic attackers
- Implement watchdog-driven recovery so that assertion-triggered aborts do not leave devices in an unusable state
# Verify NimBLE version in a Mynewt project and update the dependency
newt info | grep nimble
newt upgrade apache-mynewt-nimble@1.10.0
newt build <target>
newt load <target>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
