Executive brief
Apache NimBLE is an open-source Bluetooth Low Energy (BLE) stack. A vulnerability exists where a malformed request from a connected Bluetooth device can cause the system to crash. This issue primarily affects systems where debug assertions are disabled and requires a malfunctioning or malicious Bluetooth controller to trigger.
Technical details
A NULL pointer dereference exists in the Apache NimBLE host stack within the 'ble_sm_ltk_req_rx' function in 'ble_sm.c'. The vulnerability is triggered when the stack receives an LE Long Term Key Request event with an invalid connection handle. If debug assertions are disabled, the code fails to validate the connection object returned by 'ble_hs_conn_find_assert' before dereferencing it. An attacker with control over a Bluetooth controller or a misbehaving controller could trigger this crash. The issue is resolved in version 1.10.0 by adding a proper NULL check for the connection object.
Affected products
- Apache Software Foundation NimBLE through 1.9.0
Timeline
- 2026-07-24: advisory: CVE-2026-45816 published by Apache
- 2026-07-24: patched: Fix committed to mynewt-nimble repository