Bluetooth LE Controller Vulnerability in Nordic Semiconductor Products

CVE-2026-87040

What is CVE-2026-87040?

A flaw exists in the nRF link-layer receive paths of the open-source Bluetooth LE Controller where the LENGTH field of a received Protocol Data Unit (PDU) is not properly validated against the radio's configured maximum receive length. This oversight allows an attacker within radio range to send a crafted PDU with a length exceeding the set limit, leading to potential out-of-bounds reads and writes, which can result in memory corruption, application crashes, or the disclosure of sensitive controller memory. The vulnerability primarily affects unencrypted communications and necessitates exploitation without user authentication or interaction.

References