CVE-2026-45813: Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Sou
Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service.
Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read.
This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, which depending on device configuration may or may not require user action.
This issue affects Apache NimBLE: through 1.9.0.
Users are recommended to upgrade to version 1.10.0, which fixes the issue.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-45813
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-458130.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-45813 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Out-of-bounds Write
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highCVE-2026-34641: Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrar…nvd · 2026-07-31
- highCVE-2026-65423: An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may all…nvd · 2026-07-30
- criticalCVE-2026-47876: VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapte…nvd · 2026-07-30
- unknownCVE-2026-17544: Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap …nvd · 2026-07-30
- highCVE-2026-18022: Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to w…nvd · 2026-07-29
- unknownCVE-2026-12927: CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially …nvd · 2026-07-29
More from NVD Recent CVEs
- unknownCVE-2026-55735: Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticat…2026-08-01
- unknownCVE-2026-55734: Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guar…2026-08-01
- unknownCVE-2026-55733: Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of se…2026-08-01
- unknownCVE-2026-54894: Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of se…2026-08-01
- mediumCVE-2026-67355: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the …2026-08-01