CVE-2026-45813: 
NixOS vulnerability analysis and mitigation

CVE-2026-45813 is an Out-of-bounds Write and Integer Underflow (Wrap or Wraparound) vulnerability in the BASS (Broadcast Audio Scan Service) service of Apache NimBLE, an open-source Bluetooth Low Energy stack. Improper validation when parsing "Add Source" and "Modify Source" operation PDUs can result in a stack buffer overflow or arbitrary out-of-bounds read. All versions of Apache NimBLE through 1.9.0 are affected; the fix is available in version 1.10.0. The vulnerability was publicly disclosed on July 24, 2026, with credit to VulnCheck and researcher 侯朋朋 as reporters. It carries a CVSS v3.1 base score of 8.8 (High) (Apache Advisory, Github Advisory, oss-security).

The root cause is twofold: CWE-787 (Out-of-bounds Write) and CWE-191 (Integer Underflow / Wrap or Wraparound) in the BASS service PDU parsing logic. Specifically, the code failed to validate the number of subgroups in "Add Source" operations (allowing values exceeding the maximum supported), did not verify sufficient data was present before parsing subgroups, and incorrectly handled the Num_Subgroups field size in "Modify Source" operations — treating it as a multi-byte value instead of a single byte. The fix, merged in pull request #2232, adds bounds checks on subgroup count, validates data length before parsing, and corrects the field size handling to reject malformed operations (GitHub PR, oss-security). Exploitation requires Bluetooth adjacency and prior pairing with the target device, though depending on device configuration, pairing may or may not require user interaction (Apache Advisory).

Successful exploitation can result in a stack buffer overflow or arbitrary out-of-bounds memory read on the target device, with high impact to confidentiality, integrity, and availability. A nearby paired Bluetooth device could potentially achieve arbitrary code execution or information disclosure on the vulnerable system. Given that Apache NimBLE is commonly used in embedded and IoT devices (e.g., those running Apache Mynewt RTOS), exploitation could lead to full device compromise, persistent access, or exposure of sensitive data stored on the device (Github Advisory, oss-security).

1. Reconnaissance: Identify target devices running Apache NimBLE through 1.9.0 with the BASS service enabled, using Bluetooth scanning tools (e.g., hcitool, bluetoothctl, or specialized BLE scanners) to discover nearby advertising devices.
2. Establish Bluetooth Pairing: Initiate and complete Bluetooth pairing with the target device. Depending on device configuration, this may require user interaction (e.g., confirming a passkey) or may be automatic.
3. Connect to BASS Service: After pairing, connect to the target's GATT server and locate the Broadcast Audio Scan Service (BASS) characteristic handles.
4. Craft Malformed PDU: Construct a malformed "Add Source" or "Modify Source" operation PDU with an invalid Num_Subgroups value exceeding the maximum supported, or with insufficient data for the declared subgroups, to trigger the integer underflow or out-of-bounds write.
5. Trigger Vulnerability: Write the crafted PDU to the appropriate BASS GATT characteristic on the target device, causing a stack buffer overflow or out-of-bounds memory access.
6. Achieve Objective: Depending on the memory layout and device architecture, the overflow may enable arbitrary code execution, crash the device (denial of service), or leak memory contents (GitHub PR, oss-security).

• Network/Bluetooth: Unexpected or unauthorized Bluetooth pairing requests to devices running Apache NimBLE; unusual GATT write operations targeting BASS service characteristics from unknown paired devices.
• Logs: Device crash logs or stack traces referencing BASS service PDU parsing functions; repeated failed or malformed GATT write attempts to BASS characteristics in Bluetooth HCI logs.
• Process/System Behavior: Unexpected device reboots or crashes in embedded systems running Apache NimBLE; anomalous memory access violations or watchdog timer resets on affected IoT/embedded devices.
• File System: On devices with persistent storage, unexpected modifications to configuration or firmware files following a Bluetooth connection event.

The primary remediation is to upgrade Apache NimBLE to version 1.10.0, which includes the fix for improper BASS PDU validation (Apache Advisory, GitHub PR). If immediate patching is not feasible, restrict Bluetooth pairing to trusted, known devices only and disable the BASS service if it is not required for device functionality. Monitor for suspicious or unauthorized Bluetooth connection and pairing attempts as an interim detection measure.

The vulnerability was reported by VulnCheck and researcher 侯朋朋, and disclosed via the Apache security mailing list and oss-security on July 24, 2026 (oss-security). No significant public commentary, vendor statements beyond the Apache advisory, or notable media coverage has been identified at this time.