CVE-2026-45816CWE-476

Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request

High · published July 24, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
63.4
In the wild
Unconfirmed
What it is

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event.

This requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low.

This issue affects Apache NimBLE: through 1.9.0.

Users are recommended to upgrade to version 1.10.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01030 · 63.4th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-07-24T12:11Z
EPSS history
Timeline
  • 24 JUL 12:11Z
    Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request
    cvelistv5