CVE-2025-53470CWE-125

Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver

Low · published January 10, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
26.9
In the wild
Unconfirmed
What it is

Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver.

This issue affects Apache NimBLE: through 1.8.

This issue requires a broken or bogus Bluetooth controller and thus severity is considered low.

Users are recommended to upgrade to version 1.9, which fixes the issue.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00346 · 26.9th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-01-10T09:46Z
EPSS history
Timeline
  • 10 JAN 09:46Z
    Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver
    cvelistv5