Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

CVE-2026-45816 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2026-45816

CVE-2026-45816

HIGH7.5

Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request

Published Jul 24, 2026

Modified 1 months ago

Details

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event.

This requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low.

This issue affects Apache NimBLE: through 1.9.0.

Users are recommended to upgrade to version 1.10.0, which fixes the issue.

References

WEB

http://www.openwall.com/lists/oss-security/2026/07/24/15

FIX

https://github.com/apache/mynewt-nimble/commit/9448c5f495eb55018121b24a9dab5305c9222ea1

ADVISORY

https://lists.apache.org/thread/psppdk5j8jnq1m4jn96tnfofspgqvzvn

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-45816

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

Memory Safety

CWE-476

NULL Pointer Dereference

Ecosystems

Timeline

PublishedJul 24, 2026

ModifiedJul 24, 2026