← Voltar para CVEs

CVE-2025-53477

HIGH

7.5

Descricao

NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.

Detalhes CVE

Pontuacao CVSS v3.17.5

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado1/10/2026

Ultima modificacao1/14/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

apache:nimble

Fraquezas (CWE)

CWE-476

Referencias

https://github.com/apache/mynewt-nimble/commit/0caf9baeb271ede85fcc5237ab87ddbf938600da(security@apache.org)

https://github.com/apache/mynewt-nimble/commit/3160b8c4c7ff8db4e0f9badcdf7df684b151e077(security@apache.org)

https://lists.apache.org/thread/1dxthc132hwm2tzvjblrtnschcsbw2vo(security@apache.org)

http://www.openwall.com/lists/oss-security/2026/01/08/3(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.