CVE-2026-45813

Name of the Vulnerable Software and Affected Versions Apache NimBLE versions prior to 1.10.0

Description An integer underflow in the Apache NimBLE BASS service occurs due to improper validation when parsing Protocol Data Units (PDU) for the "Add Source" and "Modify Source" operations. This flaw can lead to a stack buffer overflow or an arbitrary out-of-bounds read. The issue can be triggered by nearby devices via a Bluetooth connection, although pairing is required to access the BASS service, which may or may not require user interaction depending on the device configuration.

Recommendations Upgrade to version 1.10.0.