Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-47773

ArduinoBLE: Memory corruption via malformed ATT write request

CVSS 4.0 7.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-47773

Published

ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected. The fix is included starting from the 2.0.2 release.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-47773

Published

ArduinoBLE

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "arduino-libraries",
                    "product": "ArduinoBLE",
                    "versions": [
                        {
                            "version": "< 2.0.2",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON