NULL Pointer Dereference Vulnerability in Apache NimBLE Software

CVE-2025-53477

What is CVE-2025-53477?

A vulnerability exists in Apache NimBLE due to insufficient validation of HCI connection complete or HCI command TX buffers, potentially leading to a NULL pointer dereference. This can occur under specific conditions, such as with disabled asserts and during interactions with a malfunctioning Bluetooth controller. Users are strongly advised to upgrade to version 1.9.0 to mitigate the risk associated with this vulnerability.

References