CVE-2025-53477: 
NixOS vulnerability analysis and mitigation

CVE-2025-53477 is a NULL Pointer Dereference vulnerability in Apache NimBLE, an open-source Bluetooth Low Energy (BLE) stack for embedded systems. The flaw stems from missing validation of the HCI connection complete event or HCI command TX buffer, which can lead to a NULL pointer dereference and application crash. It affects Apache NimBLE versions through 1.8.0, and was publicly disclosed on January 8–10, 2026, with a fix available in version 1.9.0. The CVSS v3.1 base score is 7.5 (High), assigned by CISA-ADP, though the Apache Software Foundation considers the practical severity low due to required preconditions (Openwall OSS-Sec, Apache Mailing List).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference) and exists in two locations within the NimBLE host HCI layer: ble_gap.c (handling HCI connection complete events) and ble_hs_hci_cmd.c (handling HCI command TX buffer allocation). In both cases, BLE_HS_DBG_ASSERT was the only guard against a NULL return from allocation functions, but this assert is not enabled by default in production builds. When asserts are disabled and a broken or bogus Bluetooth controller causes allocation to fail, the code proceeds to dereference the NULL pointer, causing a crash. The patches add explicit NULL checks returning BLE_HS_ENOMEM in both ble_gap_rx_conn_complete() and ble_hs_hci_cmd_send() (GitHub Patch 1, GitHub Patch 2).

Successful exploitation results in a denial-of-service (DoS) condition, causing the NimBLE host stack to crash due to a NULL pointer dereference. There is no impact on confidentiality or integrity — only availability is affected. Because NimBLE is commonly deployed on resource-constrained IoT and embedded devices, a crash could disrupt Bluetooth connectivity on affected hardware, potentially requiring a device reboot (Openwall OSS-Sec, Apache Mailing List).

The primary remediation is to upgrade Apache NimBLE to version 1.9.0 or later, which includes explicit NULL checks in both ble_gap_rx_conn_complete() and ble_hs_hci_cmd_send(). For systems that cannot upgrade immediately, enabling assert checks (BLE_HS_DBG_ASSERT) in the build configuration will mitigate the issue by catching NULL allocations before dereference. Additionally, ensuring that only trusted, properly functioning Bluetooth controller hardware is used eliminates the primary trigger condition for this vulnerability (Apache Mailing List, GitHub Patch 1, GitHub Patch 2).

The vulnerability was reported by researcher 雷重庆 and disclosed by Apache NimBLE maintainer Szymon Janc via the oss-security mailing list on January 8, 2026. Community reaction has been relatively muted given the low practical severity and constrained exploitation preconditions. Security news outlet SecurityOnline.info covered the broader set of Apache NimBLE Bluetooth flaws, and the vulnerability received brief mentions on Bluesky and Mastodon infosec communities. The Apache Software Foundation explicitly characterized the severity as low in their advisory (Openwall OSS-Sec, Apache Mynewt CVE).