CVE-2025-53470: Apache Nimble

Low severity, CVSS 3.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver. This issue affects Apache NimBLE: through 1.8.  This issue requires a broken or bogus Bluetooth controller and thus severity is considered low. Users are recommended to upgrade to version 1.9, which fixes the issue.

Affected products

• Apache Nimble: before 1.9.0 (fixed in 1.9.0)

Published 2026-01-10. Last modified 2026-06-17.