Apache NimBLE ATT Parser Assertion Failure Vulnerability

CVE-2026-45815 is a Reachable Assertion vulnerability in Apache NimBLE's Attribute (ATT) protocol parser that affects Bluetooth Low Energy (BLE) implementations. When a specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) packet is received, it triggers an assertion failure that can crash the Bluetooth stack. This vulnerability impacts any system running Apache NimBLE through version 1.9.0, including IoT devices, wearables, and embedded systems that rely on BLE connectivity. While the practical attack surface is somewhat limited—requiring an attacker to be within BLE range and the target device to first send an ATT Read Multiple Variable Request—the resulting denial of service could disrupt critical device functionality or enable further exploitation during the recovery phase.

Although this CVE currently maps to zero Casky skills, practitioners using Casky's Claude AI-powered analysis would benefit from the platform's extended reasoning capabilities to identify the attack chain. A security team analyzing this vulnerability would look for anomalous BLE packet sequences, particularly unexpected ATT responses that don't correlate with legitimate device requests. Casky's skill mapping to MITRE ATT&CK techniques would help practitioners understand this as a potential Impact technique—specifically Resource Denial of Service (T1499.004)—allowing them to assess risk within their BLE-enabled device inventory. As Apache NimBLE updates to version 1.10.0 become available, Casky would support practitioners in correlating patch deployment with their firmware inventory management and supply chain security practices.