Which CVEs affect NimBLE 1.3.0?
No note: the vendor names the CVE in its own advisory for this version (2 of 15).
| CVE | Severity | CVSS | Fixed from | Note |
|---|---|---|---|---|
| CVE-2026-45813 | high | 8.8 | 1.10.0 | per vulnerability databases |
| CVE-2025-62235 | high | 8.1 | 1.9.0 | per vulnerability databases |
| CVE-2024-24746 | high | 7.5 | 1.7.0 | |
| CVE-2024-51569 | high | 7.5 | 1.8.0 | |
| CVE-2025-52435 | high | 7.5 | 1.9.0 | per vulnerability databases |
| CVE-2025-53477 | high | 7.5 | 1.9.0 | per vulnerability databases |
| CVE-2026-45811 | high | 7.5 | 1.10.0 | per vulnerability databases |
| CVE-2026-45815 | high | 7.5 | 1.10.0 | per vulnerability databases |
| CVE-2026-45816 | high | 7.5 | 1.10.0 | per vulnerability databases |
| CVE-2026-45812 | medium | 6.5 | 1.10.0 | per vulnerability databases |
| CVE-2024-47248 | medium | 6.3 | 1.8.0 | per vulnerability databases |
| CVE-2026-46452 | medium | 5.3 | 1.10.0 | per vulnerability databases |
| CVE-2024-47249 | medium | 5.0 | 1.8.0 | per vulnerability databases |
| CVE-2024-47250 | medium | 5.0 | 1.8.0 | per vulnerability databases |
| CVE-2025-53470 | low | 3.1 | 1.9.0 | per vulnerability databases |
Which NimBLE version do I need to upgrade to?
Fixed in NimBLE 1.7.0: 1 CVE of this version.
Fixed in NimBLE 1.8.0: 4 CVEs of this version.
Fixed in NimBLE 1.9.0: 4 CVEs of this version.
Fixed in NimBLE 1.10.0: 6 CVEs of this version.
What changed against NimBLE 1.2.0?
No CVE of 1.2.0 dropped out in 1.3.0.
No CVE was added in 1.3.0.
What does the number mean for a device?
Counted are the CVEs public sources name for NimBLE version 1.3.0 (NVD). "Confirmed by the vendor" means the CVE record or advisory comes from the vendor itself and names this version as affected. Third-party records are counted but not marked as confirmed.
Whether a CVE is exploitable in a given device depends on which functions of the library the build contains and how they are configured. The list shows what is known for the version.
Questions
How many CVEs does NimBLE 1.3.0 have?
As of 13 Nov 2026, 15 CVEs are known for NimBLE 1.3.0, 0 critical and 9 high. The vendor names 2 in its own advisory for exactly this version. From NimBLE 1.10.0 on, none of these CVEs is listed.
From which version are the CVEs of NimBLE 1.3.0 fixed?
From NimBLE 1.10.0 on, none of the 15 CVEs is listed. The "Fixed in" column names the fix version per CVE.
Sources
- [1]NVD