The vulnerability is a NULL pointer dereference that occurs during the SMP Long Term Key request handling in Apache NimBLE. When an incoming LTK request triggers code that assumes a valid pointer but receives a null value, the device will crash. The issue is only present when the build has assertions disabled, and it requires a controller that supplies a malformed or otherwise misbehaving request. Because it leads to a crash, the primary impact is a denial of service rather than data exposure or code execution.

The affected vendor is the Apache Software Foundation’s Apache NimBLE. All releases up to and including version 1.9.0 are vulnerable. The vendor recommends upgrading to version 1.10.0 or later, which contains the fix.

The CVSS score of 7.5 indicates a high impact severity for a denial of service vulnerability. However, the EPSS score is below 1%, showing an extremely low probability that the flaw is being actively exploited. It is not listed in the CISA KEV catalog. Applying the information from the description, the likely attack path involves a controller sending a crafted SMP LTK request to a NimBLE‑enabled device that has disabled assertions. This requires proximity or an already compromised controller, which limits real‑world exploitability even though the technical trigger is straightforward.