CVE-2025-53477 json
Apache Mynewt NimBLE: NULL Pointer Dereference in NimBLE host HCI layer
published 2026-01-10 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-1853
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
NULL Pointer Dereference vulnerability in Apache Nimble.
Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer dereference. This issue requires disabled asserts and broken or bogus Bluetooth controller and thus severity is considered low.
This issue affects Apache NimBLE: through 1.8.0.
Users are recommended to upgrade to version 1.9.0, which fixes the issue.
Patch / fix
- apache nimble 1.9.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Apache Software Foundation Apache Mynewt NimBLE
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
References
-
github.com
/apache/mynewt-nimble/commit/0caf9baeb271ede85fcc5237ab87ddbf938600da
patch
-
github.com
/apache/mynewt-nimble/commit/3160b8c4c7ff8db4e0f9badcdf7df684b151e077
patch
-
lists.apache.org
/thread/1dxthc132hwm2tzvjblrtnschcsbw2vo
vendor-advisory, mailing-list
-
openwall.com
/lists/oss-security/2026/01/08/3
mailing-list, third-party-advisory
Sources
- CVE List CVE-2025-53477
- NVD CVE-2025-53477
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.