What’s Vulnerable › Vulnerabilities

CVE-2026-47773: ArduinoBLE: Memory corruption via malformed ATT write request

• Severity: high (CVSS 7.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-11 · updated 2026-09-30
• Weakness: CWE-131

Description

ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected. The fix is included starting from the 2.0.2 release.

Affected products

• arduino-libraries ArduinoBLE: before 2.0.2

References

• https://github.com/arduino-libraries/ArduinoBLE/pull/431/changes/1460e1a68221fca854b7b1e278cab76e763c00e6
• https://github.com/arduino-libraries/ArduinoBLE/releases/tag/2.0.2
• https://github.com/arduino-libraries/ArduinoBLE/security/advisories/GHSA-77v6-cw9f-9whg

Get alerted when CVE-2026-47773 or the next vulnerability affects your stack