Quick answers
- Is CVE-2026-45812 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45812 being exploited in the wild.
- How severe is CVE-2026-45812?
- Informational severity, with a CVSS score of 3.5, published 24 July 2026.
- Which products and versions are affected?
- Apache Software Foundation NimBLE through 1.9.0.
- Is there a fix for CVE-2026-45812?
- A patch was published on 2026-07-24: Fixed in version 1.10.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45812 attacked?
- It is attacked from the adjacent network, in a software library.
- Am I affected by CVE-2026-45812?
- Check whether you run Apache Software Foundation NimBLE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An incorrect buffer size calculation exists in Apache NimBLE's host component within the `ble_hs_hci_evt_le_adv_rpt` function. When a single HCI advertising report event contains multiple bundled reports, the code miscalculates the offset to the next report by using the size of a pointer instead of the size of the underlying structure. This results in an out-of-bounds read, causing the host to deliver a Generic Access Profile (GAP) event with invalid data to the application. The vulnerability is primarily reachable when NimBLE is paired with a third-party Bluetooth controller that batches reports, as NimBLE's own controller does not exhibit this behavior. The issue is fixed in version 1.10.0.
Affected products
- Apache Software Foundation NimBLE through 1.9.0
Timeline
- 2026-07-24: advisory: Vulnerability disclosed by Apache
- 2026-07-24: patched: Fixed in version 1.10.0