Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-14297

The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
YesWeHack

Description

A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on the linker-assigned BSS layout of the specific firmware build, which may vary.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Nordic Semiconductor ASA nRF Connect SDK

Default version status: unaffected

  • 2.2.0 to ≤ 3.3.0affected

References