# CVE-2025-44526: Realtek RTL8762E SDK improper input validation in BLE stack

Source: https://junglewise.ai/threats/cve-2025-44526-realtek-rtl8762e-sdk-improper-input-validation-in-ble-stack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-09. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-44526 · Severity: medium · CVSS 6.5 · Published 2025-07-09

A vulnerability exists in the software development kit for Realtek Bluetooth Low Energy (BLE) chips, which are commonly used in smart devices and IoT hardware. An attacker within Bluetooth range can send specially crafted data packets to overwhelm the device's processor and memory. This can cause the device to become unresponsive, drop connections, or suffer a complete service outage, effectively disabling its wireless functionality.

Vendors: [Realtek](https://junglewise.ai/threats/vendors/realtek).

## Quick answers

**Is CVE-2025-44526 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-44526 being exploited in the wild.

**How severe is CVE-2025-44526?** Medium severity, with a CVSS score of 6.5, published 9 July 2025.

**Which products and versions are affected?** Realtek RTL8762E SDK 1.4.0; Realtek Rtl8762ekf-Evb -.

**Is there a fix for CVE-2025-44526?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-44526 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2025-44526?** Check whether you run Realtek RTL8762E SDK, Realtek Rtl8762e Software Development Kit or Realtek Rtl8762ekf-Evb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as Improper Input Validation (CWE-20) within the BLE stack's PDU reception and fragment handling component. The Realtek RTL8762E SDK V1.4.0 fails to enforce the Bluetooth Core Specification's minimum PDU length of 27 bytes, improperly accepting fragmented packets as small as 1-5 bytes. An unauthenticated attacker in wireless proximity (adjacent) can flood the target with these undersized PDUs or initiate multiple concurrent sessions to exhaust CPU and memory resources. This resource exhaustion leads to significant performance degradation or a complete Denial of Service (DoS) of the BLE communication stack.

## Affected products

- Realtek RTL8762E SDK 1.4.0
- Realtek RTL8762EKF-EVB -

## Timeline

- 2025-07-09: advisory: Initial NVD publication date

## References

- [http://rtl8762ekf-evb.com/](http://rtl8762ekf-evb.com/)
- [https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Realtek/Improper_Validation_of_BLE_PDU_Length.md](https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Realtek/Improper_Validation_of_BLE_PDU_Length.md)