CVE-2025-53470: 
NixOS vulnerability analysis and mitigation

CVE-2025-53470 is an out-of-bounds read vulnerability in the Apache NimBLE HCI H4 Bluetooth driver. A specially crafted HCI event can trigger an invalid memory read in the H4 driver, potentially leading to limited information disclosure. The vulnerability affects Apache NimBLE through version 1.8, and was disclosed on January 8–10, 2026, with a fix available in version 1.9. It carries a CVSS v3.1 base score of 3.1 (Low), assessed by CISA-ADP, reflecting the constrained exploitation conditions (Apache Mailing List, Openwall oss-security).

The root cause is classified as CWE-125 (Out-of-bounds Read). In the hci_h4_sm_w4_header function within nimble/transport/common/hci_h4/src/hci_h4.c, the driver calculates an expected event length (exp_len = hdr[1] + 2) without validating it against the maximum allowed buffer size (BLE_TRANSPORT_EVT_SIZE). If a received HCI event is oversized, the driver proceeds to parse it, resulting in an invalid memory read beyond the allocated buffer. The fix adds a bounds check that returns an error and halts parsing when the expected length exceeds the configured maximum (GitHub Patch). Exploitation requires a broken or bogus Bluetooth controller capable of sending malformed HCI events, significantly limiting the practical attack surface (Openwall oss-security).

Successful exploitation can result in a limited confidentiality impact through unintended memory reads, potentially leaking small amounts of memory content from the affected device. There is no impact on integrity or availability, as the vulnerability does not allow memory writes or denial of service. The attack vector is adjacent network (Bluetooth), and exploitation requires a non-standard, malicious or malfunctioning Bluetooth controller, making real-world impact scenarios narrow (Openwall oss-security, Apache Mailing List).

Users should upgrade Apache NimBLE to version 1.9 or later, which includes the fix that adds a bounds check before parsing HCI events. The patch is available in the official Apache mynewt-nimble repository. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation. Given the low severity and constrained exploitation conditions, organizations should prioritize patching in environments where untrusted or third-party Bluetooth controllers may be present (GitHub Patch, Apache Mailing List).

The vulnerability was reported by researcher 雷重庆 and disclosed by Apache NimBLE maintainer Szymon Janc via the oss-security mailing list on January 8, 2026. Community reaction has been muted given the low severity rating and the constrained exploitation prerequisites. Security news outlets such as SecurityOnline.info covered the disclosure in the context of broader Apache NimBLE Bluetooth flaws (Openwall oss-security).