Multiple stack-based buffer overflow vulnerabilities exist in SimpleBLE versions prior to 0.14.0. The vulnerabilities affect the dongl backend’s Protocol::simpleble_write function for local caller‑controlled input and also arise when processing manufacturer‑specific and service data in BLE advertisements, which can be triggered remotely without any pairing or connection. These overflows can allow an attacker to corrupt the stack and potentially execute arbitrary code, compromising confidentiality, integrity, and availability of the targeted system.

The affected vendor and product are simpleble:simpleble. All releases before version 0.14.0 are vulnerable. Users who compile or link against any SimpleBLE library older than 0.14.0 are at risk.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, but the absence of a KEV listing does not reduce the likelihood of exploitation, especially because the BLE advertisement based vectors are remote and require no authentication. The known vulnerable functions can be targeted by simply broadcasting malicious BLE packets, making the attack path easy for attackers with Bluetooth hardware. The patch is available, so the risk can be mitigated by upgrading.