CVE-2026-47773 Overview
CVE-2026-47773 is a memory corruption vulnerability in ArduinoBLE, the library that provides Bluetooth Low Energy (BLE) connectivity for certain Arduino boards. Versions prior to 2.0.2 lack a bounds check in the Attribute Protocol (ATT) layer write request handler. A remote, unauthenticated BLE client within radio range can send crafted write requests to corrupt memory in the global ATTClass object. Devices are affected when at least one characteristic is configured with the BLEEncryption property. The issue is categorized under [CWE-131] Incorrect Calculation of Buffer Size and was fixed in ArduinoBLE 2.0.2.
Critical Impact
An adjacent, unauthenticated attacker can corrupt memory on affected Arduino devices over BLE, leading to integrity and availability compromise.
Affected Products
- ArduinoBLE library versions prior to 2.0.2
- Arduino boards running ArduinoBLE with at least one characteristic using the BLEEncryption property
- Embedded and IoT deployments exposing BLE peripherals built on ArduinoBLE
Discovery Timeline
- 2026-09-11 - CVE-2026-47773 published to the National Vulnerability Database (NVD)
- 2026-09-15 - Last updated in the NVD database
Technical Details for CVE-2026-47773
Vulnerability Analysis
The flaw resides in the ATT layer write request handler within ArduinoBLE. When a peer BLE client sends an ATT write request, the handler processes the incoming payload without validating its length against the destination buffer inside the global ATTClass object. An attacker can supply an oversized write request, causing writes beyond the intended boundary.
Because ATTClass is a global object holding connection and attribute state, memory corruption in this region can overwrite adjacent fields used by the BLE stack. Successful exploitation allows an attacker to alter device state or crash the firmware. The vulnerability is reachable only when a characteristic is registered with the BLEEncryption property, which routes writes through the vulnerable code path.
Root Cause
The root cause is a missing bounds check on ATT write request payload length before copying attacker-controlled data into a fixed-size buffer in the ATTClass global. This maps to [CWE-131], where the buffer size calculation is incorrect or absent, allowing writes past the allocated region.
Attack Vector
Exploitation requires BLE radio proximity to the target device. The attacker does not need pairing, authentication, or user interaction. The attacker connects to the vulnerable peripheral and issues an ATT write request against a characteristic configured with BLEEncryption, delivering an oversized payload that overflows into adjacent memory. See the GitHub Security Advisory GHSA-77v6-cw9f-9whg and the pull request implementing the fix for technical details.
Detection Methods for CVE-2026-47773
Indicators of Compromise
- Unexpected reboots, watchdog resets, or firmware crashes on Arduino devices exposing BLE services
- BLE peripherals dropping connections or entering an unresponsive state after receiving write requests
- Anomalous ATT write requests with payload sizes exceeding declared characteristic value lengths
Detection Strategies
- Inventory embedded devices to identify firmware built with ArduinoBLE versions prior to 2.0.2
- Review firmware source for characteristics declared with the BLEEncryption property to confirm exposure
- Capture BLE traffic near critical devices and inspect ATT Write Request PDUs for oversized values
Monitoring Recommendations
- Deploy BLE sniffers or wireless intrusion detection near sensitive Arduino-based deployments to log ATT-layer activity
- Alert on repeated BLE connection attempts from unknown peer addresses targeting affected peripherals
- Track device availability metrics and correlate unexpected resets with nearby BLE activity
How to Mitigate CVE-2026-47773
Immediate Actions Required
- Upgrade the ArduinoBLE library to version 2.0.2 or later and reflash all affected devices
- Identify every deployed device that uses characteristics with the BLEEncryption property and prioritize their remediation
- Restrict physical or radio access to affected devices until firmware is updated
Patch Information
The fix is included in ArduinoBLE 2.0.2. Download the patched release from the ArduinoBLE 2.0.2 release page. The upstream change adding the missing bounds validation is available in the ArduinoBLE pull request #431. Rebuild firmware against the patched library and redeploy to all impacted boards.
Workarounds
- Temporarily remove or disable characteristics that use the BLEEncryption property until firmware can be updated
- Reduce BLE transmit power or physically isolate devices to limit adjacent-network exposure
- Disable the BLE peripheral role entirely on devices where BLE is not required for operation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
