CVE-2024-47248
Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE.
Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0.
Users are recommended to upgrade to version 1.8.0, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE.
Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0.
Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- Record
CVE-2024-47248- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2024-42788
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE.
Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0.
Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- Record
EUVD-2024-42788- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f94q-ffqr-x638
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache...
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE.
Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0.
Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- Record
GHSA-f94q-ffqr-x638- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE.
Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0.
Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- Record
CVE-2024-47248- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-120
- Updated
- 2026-11-02
OSV
Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE.
Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0.
Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- Record
CVE-2024-47248- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-120
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-47248 is a medium vulnerability (CVSS 6.3) in Apache Nimble, published November 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. No source names a fixed version.
References
lists.apache.org/thread/z8m7jqh54xybf9kz8q2l3tz92zsj7tmz
github.com/apache/mynewt-nimble/commit/4f75c0b3b466186beff40e8489870c6cee076aaa
openwall.com/lists/oss-security/2024/11/26/2
nvd.nist.gov/vuln/detail/CVE-2024-47248