# CVE-2026-14297: Nordic Semiconductor Bluetooth CGMS buffer overflow in RACP handler

Source: https://junglewise.ai/threats/cve-2026-14297-nordic-semiconductor-bluetooth-cgms-buffer-overflow-in-racp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-14297 · Severity: info · Published 2026-09-07

Nordic Semiconductor's Bluetooth-enabled devices implement a Continuous Glucose Monitoring Service used in medical and fitness devices. A buffer overflow in the RACP (Record Access Control Point) write handler allows an authenticated attacker to overwrite adjacent memory, potentially causing device malfunction or enabling further exploitation depending on the specific device's memory layout.

Vendors: [Nordic Semiconductor](https://junglewise.ai/threats/vendors/nordic-semiconductor).

## Quick answers

**Is CVE-2026-14297 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14297 being exploited in the wild.

**How severe is CVE-2026-14297?** Informational severity, published 7 September 2026.

**Which products and versions are affected?** Nordic Semiconductor Bluetooth CGMS implementation.

**Is there a fix for CVE-2026-14297?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14297 attacked?** It is attacked from the adjacent network or over the network, in device firmware.

**Am I affected by CVE-2026-14297?** Check whether you run Nordic Semiconductor Bluetooth CGMS implementation. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow vulnerability exists in the Bluetooth CGMS Record Access Control Point (RACP) write handler, where a 20-byte static buffer can be overflowed into adjacent BSS (Block Started by Symbol) memory. The vulnerability requires an authenticated BLE peer within wireless range and involves writing malformed data to the RACP characteristic. The impact is dependent on the linker-assigned memory layout of the specific firmware build, making exploitation unpredictable but potentially enabling code execution or denial of service. The reported severity and lack of CVSS scoring suggest limited immediate exploitability or impact assessments available at disclosure.

## Affected products

- Nordic Semiconductor Bluetooth CGMS implementation

## Timeline

- 2026-09-07: disclosed

## References

- [https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html](https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html)