PatchSiren cyber security CVE debrief
CVE-2026-44634 SimpleBLE CVE debrief
CVE-2026-44634 is a HIGH-severity vulnerability with a CVSS score of 8.7. Multiple stack-based buffer overflow vulnerabilities were discovered in SimpleBLE, a cross-platform library and bindings for Bluetooth Low Energy (BLE). The vulnerabilities exist in the dongl backend's Protocol::simpleble_write function, as well as when processing manufacturer-specific data and service data in BLE advertisements. These issues have been patched in version 0.14.0.
- Vendor
- SimpleBLE
- Product
- SimpleBLE
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-10
- Original CVE updated
- 2026-06-10
- Advisory published
- 2026-06-10
- Advisory updated
- 2026-06-10
Who should care
Users of SimpleBLE versions prior to 0.14.0 should upgrade to the latest version to mitigate these vulnerabilities.
Technical summary
The vulnerabilities are caused by stack-based buffer overflows in the following areas: 1) the dongl backend's Protocol::simpleble_write function, which allows local, caller-controlled input; 2) processing manufacturer-specific data in BLE advertisements, which can be exploited remotely without pairing or connection; and 3) processing service data in BLE advertisements, also exploitable remotely without pairing or connection.
Defensive priority
HIGH
Recommended defensive actions
- Upgrade to SimpleBLE version 0.14.0 or later.
- Review and apply patches as described in [ref-6](https://github.com/simpleble/simpleble/releases/tag/v0.14.0) and [ref-7](https://github.com/simpleble/simpleble/security/advisories/GHSA-8h89-q8m2-c8fp).
Evidence notes
CVE-2026-44634 was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-44634) and last modified on [cveModifiedAt](https://nvd.nist.gov/vuln/detail/CVE-2026-44634).
Official resources
CVE-2026-44634 was published on 2026-06-10T01:16:27.080Z and last modified on 2026-06-10T20:19:06.020Z.