CVE-2024-47249

published 2024-11-26

CVE-2024-47249: Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory…

Priority P4 23 medium 5 CVSS 3.1

AV A AC H PR N UI N S U C L I L A L

Improper Validation of Array Index vulnerability in Apache NimBLE.

Lack of input validation for HCI events from controller could result in out-of-bound memory corruption and crash.
This issue requires broken or bogus Bluetooth controller and thus severity is considered low.
This issue affects Apache NimBLE: through 1.7.0.

Users are recommended to upgrade to version 1.8.0, which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	nimble	< 1.8.0	1.8.0
apache_software_foundation	apache_nimble	<= 1.7.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-129