Description
Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, which depending on device configuration may or may not require user action. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.
Affected products
apache: nimble
References3
- lists.apache.org/thread/vc1ny73w243z5wr6t0y10gc6t2c9cytw Mailing ListVendor Advisory
- github.com/apache/mynewt-nimble/pull/2232 Issue TrackingPatch
- www.openwall.com/lists/oss-security/2026/07/24/13 Mailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: CNA
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 45 · as of 14 November 2026
- CWE
- CWE-191CWE-787
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.