Is CVE-2026-46452 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46452 being exploited in the wild.

How severe is CVE-2026-46452?

Informational severity, with a CVSS score of 0, published 24 July 2026.

Which products and versions are affected?

Apache Software Foundation NimBLE through 1.9.0.

Is there a fix for CVE-2026-46452?

A patch was published on 2026-07-24: Fix committed to the mynewt-nimble repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46452 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46452?

Check whether you run Apache Software Foundation NimBLE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46452: Apache NimBLE Improper Input Validation in Mesh Proxy SAR reassembly

CVE-2026-46452 · Severity: info · CVSS 0 · Published 2026-07-24

Apache NimBLE is an open-source Bluetooth Low Energy stack used in embedded devices. A flaw in how it handles Bluetooth Mesh Proxy messages could allow malformed data to be processed by the system. This can lead to memory pressure and unstable behavior, potentially causing the device to crash or become unresponsive.

Technologies: Apache Software Foundation NimBLE. Vendors: Apache Software Foundation.

Quick answers

Is CVE-2026-46452 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46452 being exploited in the wild.
How severe is CVE-2026-46452?: Informational severity, with a CVSS score of 0, published 24 July 2026.
Which products and versions are affected?: Apache Software Foundation NimBLE through 1.9.0.
Is there a fix for CVE-2026-46452?: A patch was published on 2026-07-24: Fix committed to the mynewt-nimble repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46452 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46452?: Check whether you run Apache Software Foundation NimBLE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper input validation vulnerability exists in the Apache NimBLE Bluetooth stack within the Mesh Proxy Segmentation and Reassembly (SAR) component. The root cause is a failure to check available buffer space in 'proxy_msg.c' before appending data during message reassembly. An attacker within Bluetooth range could potentially send malformed Mesh Proxy PDUs to trigger a buffer overflow condition, leading to the delivery of corrupted data to higher-layer applications and causing memory exhaustion or parsing instability. The issue is fixed in version 1.10.0 by implementing tailroom checks before data concatenation.

Affected products

Apache Software Foundation NimBLE through 1.9.0

Timeline

2026-07-24: advisory: NVD and Apache Software Foundation published the advisory.
2026-07-24: patched: Fix committed to the mynewt-nimble repository.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.