Apache NimBLE contains a classic buffer overflow in the HCI socket transport: the implementation copies a received HCI event into the event pool without verifying that the event will fit. This unchecked memory copy can corrupt memory, potentially causing a crash or other unintended behavior. The weakness is a classic buffer copy without size checking (CWE‑120).

All Apache NimBLE releases up to and including version 1.9.0 are affected. The vulnerable component is the HCI socket transport within the NimBLE Bluetooth stack developed by the Apache Software Foundation. Versions 1.10.0 and later contain the fix and thus are not impacted.

The CVSS score of 7.5 classifies the vulnerability as high severity. The EPSS score is below 1 %, indicating that exploitation is currently uncommon. This issue is not listed in CISA’s KEV catalog. Exploitation requires either that an attacker controls a misconfigured HCI event pool size or that a malicious or compromised controller is able to send oversized or crafted events over the HCI socket link. Over‑the‑air Bluetooth access does not trigger the flaw, so the attack surface is limited to environments where the controller socket can be influenced by the adversary.