CVE-2026-14297: The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.
Published Sep 7, 2026
·Updated
A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on the linker-assigned BSS layout of the specific firmware build, which may vary.
Affected Software
1 affected component
Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler
Event History
Sep 7, 2026
CVE Published
via MITRE·08:07 AM
Data Sourced
via MITRE·08:07 AM
DescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need?
The attacker must be an authenticated BLE peer and be able to submit a write to the CGMS RACP handler. The supplied ATT write value must exceed the handler's fixed 20-byte buffer.
2
Is the resulting impact consistent across affected firmware?
No. The effect depends on the adjacent BSS memory layout assigned by the linker for the specific firmware build, so exploitability and impact may vary between builds.