CVE-2026-47773

HighCVSS 7.2/10Last modified Sep 30, 2026

Description

ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected. The fix is included starting from the 2.0.2 release.

Metrics

CVSS 4.0 7.2/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-131 CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 11, 2026
Last modified: Sep 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-477747.5Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 CVE-2026-477756.8Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAu CVE-2026-477777.5Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote CVE-2026-477784.4Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a struc CVE-2026-47786.5A weakness has been identified in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file update_CVE-2026-477806.9free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscrip CVE-2026-477818.4PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a CVE-2026-477824.6Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user conf CVE-2026-477838.1In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon a CVE-2026-477848.1In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl CVE-2026-477869.3An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote att CVE-2026-47798.8A security vulnerability has been detected in SourceCodester Sales and Inventory System 1.0. This issue affects some unknown processing of t