CVE-2026-47773: ArduinoBLE: Memory corruption via malformed ATT write request
ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected. The fix is included starting from the 2.0.2 release.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ArduinoBLEto a version that resolves this vulnerability.Fixed in 2.0.2 - Compensating control
For affected installations prior to ArduinoBLE 2.0.2, ensure any BLE characteristics configured with the BLEEncryption property are not exposed to remote unauthenticated clients until upgraded.
Event History
Frequently Asked Questions
Which deployments are affected?
Devices using ArduinoBLE versions earlier than 2.0.2 are affected when they have one or more BLE characteristics configured with the BLEEncryption property.
What access does an attacker need?
An attacker needs to be a remote BLE client within Bluetooth Low Energy communication range. The malformed ATT write request can be sent without authentication.
Does enabling BLE encryption prevent exploitation?
No. Characteristics configured with the BLEEncryption property are specifically part of the affected configuration, and the attacker is described as unauthenticated.
What is the remediation?
Update ArduinoBLE to version 2.0.2 or later, which includes the fix.