CVE-2024-47248CWE-120

Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack

Medium · published November 26, 2024

CVSS v3.1
6.3
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE.

Specially crafted MESH message could result in memory corruption when non-default build configuration is used.

This issue affects Apache NimBLE: through 1.7.0.

Users are recommended to upgrade to version 1.8.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00721 · 53.4th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2024-11-26T11:15Z
EPSS history
Timeline
  • 26 NOV 11:15Z
    Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack
    cvelistv5