Executive brief
A vulnerability exists in the software development kit for Realtek Bluetooth Low Energy (BLE) chips, which are commonly used in smart devices and IoT hardware. An attacker within Bluetooth range can send specially crafted data packets to overwhelm the device's processor and memory. This can cause the device to become unresponsive, drop connections, or suffer a complete service outage, effectively disabling its wireless functionality.
Technical details
The vulnerability is classified as Improper Input Validation (CWE-20) within the BLE stack's PDU reception and fragment handling component. The Realtek RTL8762E SDK V1.4.0 fails to enforce the Bluetooth Core Specification's minimum PDU length of 27 bytes, improperly accepting fragmented packets as small as 1-5 bytes. An unauthenticated attacker in wireless proximity (adjacent) can flood the target with these undersized PDUs or initiate multiple concurrent sessions to exhaust CPU and memory resources. This resource exhaustion leads to significant performance degradation or a complete Denial of Service (DoS) of the BLE communication stack.
Affected products
- Realtek RTL8762E SDK 1.4.0
- Realtek RTL8762EKF-EVB -
Timeline
- 2025-07-09: advisory: Initial NVD publication date