CVE-2026-45812: 
NixOS vulnerability analysis and mitigation

CVE-2026-45812 is an Incorrect Calculation of Buffer Size vulnerability (CWE-131) in Apache NimBLE, an open-source Bluetooth Low Energy stack, affecting all versions through 1.9.0. When processing Legacy Advertising Report HCI events that bundle multiple reports into a single event, NimBLE miscalculates the offset to the next report, causing an out-of-bounds read. The vulnerability was disclosed on July 24, 2026, with a fix released in version 1.10.0. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Apache Advisory).

The root cause is a classic C pointer-vs-value bug in nimble/host/src/ble_hs_hci_evt.c. In the ble_hs_hci_evt_le_adv_rpt() function, the loop advancing through multiple advertising reports used sizeof(rpt) (the size of a pointer, typically 4 or 8 bytes) instead of sizeof(*rpt) (the size of the actual struct), causing the offset calculation to be incorrect for subsequent reports (GitHub Commit). This off-by-size error causes the host to read past the end of the HCI event buffer and deliver a GAP event populated with out-of-bounds memory data to the application. Exploitation requires a third-party Bluetooth controller that batches multiple Legacy Advertising Reports into a single HCI event, as NimBLE's own controller never performs this batching (oss-security).

Successful exploitation results in a memory disclosure (out-of-bounds read), where sensitive data from beyond the intended buffer boundary is delivered to the application via a GAP event. There is no integrity or availability impact — the vulnerability is limited to confidentiality. The practical impact is constrained by the requirement for a third-party Bluetooth controller that batches advertising reports, limiting the affected deployment surface (Github Advisory, Apache Advisory).

Users should upgrade Apache NimBLE to version 1.10.0, which corrects the buffer size calculation with a one-character fix (sizeof(*rpt) instead of sizeof(rpt)) (GitHub Commit). If immediate patching is not feasible, a practical workaround is to avoid pairing NimBLE's host stack with third-party Bluetooth controllers known to batch multiple Legacy Advertising Reports into a single HCI event, or to disable Legacy Advertising Report processing if the application permits it (Apache Advisory).

The vulnerability was reported by VulnCheck and disclosed by Apache NimBLE maintainer Szymon Janc via the oss-security mailing list on July 24, 2026, with the severity self-assessed as low due to the constrained exploitation conditions (oss-security). No significant broader media coverage or notable community debate has been observed beyond standard vulnerability tracking and aggregation sites.