{"id":"CVE-2026-14297","aliases":["EUVD-2026-72299","GHSA-9789-mpm3-jqwq"],"status":"published","title":"The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.","description":"A buffer overflow in the Bluetooth Continuous Glucose\n     Monitoring Service (CGMS) Record Access Control Point (RACP) write handler\n     allows an authenticated BLE peer to overflow a 20-byte static buffer into\n     adjacent BSS memory. The exploitable impact cannot be predetermined - it\n     is entirely dependent on the linker-assigned BSS layout of the specific\n     firmware build, which may vary.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0024,"percentile":0.15241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2026-09-07T08:07:08Z","modified":"2026-09-09T15:50:19Z","products":[{"vendor":"nordic semiconductor asa","product":"nrf connect sdk"}],"references":[{"url":"https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14297"},{"url":"https://github.com/advisories/GHSA-9789-mpm3-jqwq"}],"sources":{"cve":[{"id":"CVE-2026-14297","title":"The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.","description":"A buffer overflow in the Bluetooth Continuous Glucose\n     Monitoring Service (CGMS) Record Access Control Point (RACP) write handler\n     allows an authenticated BLE peer to overflow a 20-byte static buffer into\n     adjacent BSS memory. The exploitable impact cannot be predetermined - it\n     is entirely dependent on the linker-assigned BSS layout of the specific\n     firmware build, which may vary.","status":"published","published":"2026-09-07T08:07:08.746Z","modified":"2026-09-08T15:01:09.643Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-72299","description":"A buffer overflow in the Bluetooth Continuous Glucose\n     Monitoring Service (CGMS) Record Access Control Point (RACP) write handler\n     allows an authenticated BLE peer to overflow a 20-byte static buffer into\n     adjacent BSS memory. The exploitable impact cannot be predetermined - it\n     is entirely dependent on the linker-assigned BSS layout of the specific\n     firmware build, which may vary.","status":"published","published":"2026-09-07T08:07:08Z","modified":"2026-09-08T15:01:09Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:29.426Z"}],"ghsa":[{"id":"GHSA-9789-mpm3-jqwq","title":"A buffer overflow in the Bluetooth Continuous Glucose\n     Monitoring Service (CGMS) Record...","description":"A buffer overflow in the Bluetooth Continuous Glucose\n     Monitoring Service (CGMS) Record Access Control Point (RACP) write handler\n     allows an authenticated BLE peer to overflow a 20-byte static buffer into\n     adjacent BSS memory. The exploitable impact cannot be predetermined - it\n     is entirely dependent on the linker-assigned BSS layout of the specific\n     firmware build, which may vary.","status":"published","published":"2026-09-07T09:31:39Z","modified":"2026-09-07T09:31:47Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:11:26.557204Z"}],"nvd":[{"id":"CVE-2026-14297","description":"A buffer overflow in the Bluetooth Continuous Glucose\n     Monitoring Service (CGMS) Record Access Control Point (RACP) write handler\n     allows an authenticated BLE peer to overflow a 20-byte static buffer into\n     adjacent BSS memory. The exploitable impact cannot be predetermined - it\n     is entirely dependent on the linker-assigned BSS layout of the specific\n     firmware build, which may vary.","status":"published","published":"2026-09-07T09:17:15.43Z","modified":"2026-09-09T15:50:19.447Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:44.082631Z"}]}}