Vulnerability details
CVE-2026-47773
arduino-libraries ArduinoBLE
ArduinoBLE: Memory corruption via malformed ATT write request
CVSS 4.0
7.2High
Official description
ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected. The fix is included starting from the 2.0.2 release.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.2High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| arduino-libraries | ArduinoBLE | < 2.0.2 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/arduino-libraries/ArduinoBLE/security/advisories/GHSA-77v6-cw9f-9whg x_refsource_CONFIRM
- https://github.com/arduino-libraries/ArduinoBLE/pull/431/changes/1460e1a68221fca854b7b1e278cab76e763c00e6 x_refsource_MISC
- https://github.com/arduino-libraries/ArduinoBLE/releases/tag/2.0.2 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-12
- Last updated
- 2026-09-15
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.15%
Probability of exploitation in 30 days
4.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-131Incorrect Calculation of Buffer Size
- CWE-787Out-of-bounds Write