Quick answers
- Is CVE-2026-45816 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45816 being exploited in the wild.
- How severe is CVE-2026-45816?
- Informational severity, with a CVSS score of 2.1, published 24 July 2026.
- Which products and versions are affected?
- Apache Software Foundation NimBLE through 1.9.0.
- Is there a fix for CVE-2026-45816?
- A patch was published on 2026-07-24: Fix committed to mynewt-nimble repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45816 attacked?
- It is attacked from the adjacent network, in a software library.
- Am I affected by CVE-2026-45816?
- Check whether you run Apache Software Foundation NimBLE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A NULL pointer dereference exists in the Apache NimBLE host stack within the 'ble_sm_ltk_req_rx' function in 'ble_sm.c'. The vulnerability is triggered when the stack receives an LE Long Term Key Request event with an invalid connection handle. If debug assertions are disabled, the code fails to validate the connection object returned by 'ble_hs_conn_find_assert' before dereferencing it. An attacker with control over a Bluetooth controller or a misbehaving controller could trigger this crash. The issue is resolved in version 1.10.0 by adding a proper NULL check for the connection object.
Affected products
- Apache Software Foundation NimBLE through 1.9.0
Timeline
- 2026-07-24: advisory: CVE-2026-45816 published by Apache
- 2026-07-24: patched: Fix committed to mynewt-nimble repository