CVE-2026-47773CWE-131CWE-787

CVE-2026-47773

published September 12, 2026

CVSS
7.2
EPSS
0%
Percentile
3.9
In the wild
Unconfirmed
What it is

ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected. The fix is included starting from the 2.0.2 release.

The record
Technical detail
CVSS
7.2 · NONE
CVSS v4.0
7.2 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00150 · 3.9th percentile
Weaknesses
CWE-131 · Incorrect Calculation of Buffer Size; CWE-787 · Out-of-bounds Write
Published
2026-09-12T01:17Z
References (3)
https://github.com/arduino-libraries/ArduinoBLE/pull/431/changes/1460e1a68221fca854b7b1e278cab76e763c00e6 · [email protected]https://github.com/arduino-libraries/ArduinoBLE/releases/tag/2.0.2 · [email protected]https://github.com/arduino-libraries/ArduinoBLE/security/advisories/GHSA-77v6-cw9f-9whg · [email protected]
EPSS history
Timeline
  • 13 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 11 SEP 21:03Z
    ArduinoBLE: Memory corruption via malformed ATT write request
    cvelistv5