High severity · published Jul 24, 2026
CVE-2026-45816
Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request
7.5
CVSS
1%
EPSS
No
On KEV
Description
NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event.
This requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Apache NimBLE · Apache Software Foundation
through 1.9.0 · source: vendor
NI
Nimble · Apache
before 1.10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45816
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45816
Patch
https://github.com/apache/mynewt-nimble/commit/9448c5f495eb55018121b24a9dab5305c9222ea1
Mailing List
https://lists.apache.org/thread/psppdk5j8jnq1m4jn96tnfofspgqvzvn
Mailing List
http://www.openwall.com/lists/oss-security/2026/07/24/15
More from Apache NimBLE
8.8
CVE-2026-45813
Apache NimBLE: Incorrect data validation in BASS add/modify source operation
7.5
CVE-2026-45815
Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler
7.5
CVE-2026-45811
Apache NimBLE: Buffer overflow in socket HCI transport
7.5
CVE-2024-51569
Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler
7.5
CVE-2024-24746
Apache NimBLE: Denial of service in NimBLE Bluetooth stack