Executive brief
Apache NimBLE is an open-source Bluetooth Low Energy stack used in embedded devices. A flaw in how it handles Bluetooth Mesh Proxy messages could allow malformed data to be processed by the system. This can lead to memory pressure and unstable behavior, potentially causing the device to crash or become unresponsive.
Technical details
An improper input validation vulnerability exists in the Apache NimBLE Bluetooth stack within the Mesh Proxy Segmentation and Reassembly (SAR) component. The root cause is a failure to check available buffer space in 'proxy_msg.c' before appending data during message reassembly. An attacker within Bluetooth range could potentially send malformed Mesh Proxy PDUs to trigger a buffer overflow condition, leading to the delivery of corrupted data to higher-layer applications and causing memory exhaustion or parsing instability. The issue is fixed in version 1.10.0 by implementing tailroom checks before data concatenation.
Affected products
- Apache Software Foundation NimBLE through 1.9.0
Timeline
- 2026-07-24: advisory: NVD and Apache Software Foundation published the advisory.
- 2026-07-24: patched: Fix committed to the mynewt-nimble repository.