High severity · published Jan 10, 2026
CVE-2025-53477
Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
NULL Pointer Dereference vulnerability in Apache Nimble.
Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference.
This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low.
This issue affects Apache NimBLE: through 1.8.0.
Users are recommended to upgrade to version 1.9.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Apache Mynewt NimBLE · Apache Software Foundation
through 1.8.0 · source: vendor
NI
Nimble · Apache
before 1.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53477
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53477
Patch
https://github.com/apache/mynewt-nimble/commit/0caf9baeb271ede85fcc5237ab87ddbf938600da
Patch
https://github.com/apache/mynewt-nimble/commit/3160b8c4c7ff8db4e0f9badcdf7df684b151e077
Mailing List
https://lists.apache.org/thread/1dxthc132hwm2tzvjblrtnschcsbw2vo
Mailing List
http://www.openwall.com/lists/oss-security/2026/01/08/3
More from Apache Mynewt NimBLE
8.1
CVE-2025-62235
Apache Mynewt NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing
7.5
CVE-2025-52435
Apache Mynewt NimBLE: Invalid error handling in pause encryption procedure in NimBLE controller
3.1
CVE-2025-53470
Apache Mynewt NimBLE: Out-of-Bounds Write Vulnerability in NimBLE HCI H4 driver