Executive brief
SimpleBLE is a library used by developers to add Bluetooth Low Energy (BLE) functionality to applications across different operating systems. Multiple security flaws allow an attacker within Bluetooth range to crash an application or potentially take control of a device by sending malicious Bluetooth signals. No user interaction or device pairing is required for an attacker to trigger these vulnerabilities.
Technical details
SimpleBLE prior to version 0.14.0 is vulnerable to three distinct stack-based buffer overflows (CWE-121). Two of these are remotely exploitable via unauthenticated BLE advertisement packets containing malformed manufacturer-specific data or service data; these require no pairing or connection. The third vulnerability exists in the 'dongl' backend's Protocol::simpleble_write function and is triggered by local, caller-controlled input. These flaws result from insufficient bounds checking when copying variable-length BLE data into fixed-size stack buffers. Exploitation could lead to arbitrary code execution or a denial of service (DoS). The issues are addressed in version 0.14.0.
Affected products
- SimpleBLE SimpleBLE <= 0.12.2
Timeline
- 2026-05-01: patched: Fixes merged into main branch via PR 466
- 2026-05-02: other: Release v0.14.0 published
- 2026-05-15: advisory: GitHub Security Advisory GHSA-8h89-q8m2-c8fp published
- 2026-06-10: disclosed: CVE-2026-44634 published to NVD