NimBLE miscalculates the buffer offset when processing a Legacy Advertising Report HCI event that contains multiple reports. This bug results in an out‑of‑bounds read, producing a GAP event with incorrect data. The weakness is a classic heap corruption scenario described by CWE‑131, where the size of a buffer is incorrectly determined. This vulnerability does not enable direct code execution or privilege escalation; its effect is confined to data integrity and availability of the BLE stack. The attack vector is inferred to involve a crafted advertising packet supplied by a third‑party controller that batches reports into a single HCI event, which is a non‑native behavior of NimBLE. The vulnerability might cause data corruption or a denial of service when the application consumes the malformed GAP event.

Apache NimBLE releases up to and including 1.9.0 are affected. The improper buffer size calculation is present in all versions through 1.9.0. Users are advised to upgrade to Apache NimBLE 1.10.0 or later, where the calculation has been corrected. The defect is relevant only when NimBLE’s host is paired with a third‑party controller that groups multiple advertising reports into a single event.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog. Exploitation requires the presence of a third‑party controller that bundles multiple advertising reports, a scenario that is uncommon in most deployments. Consequently, the overall risk to a system is low, but the impact could be significant if the host processes malformed GAP events.