Vulnerability · Published Sep 7, 2026 · Assigned by YesWeHack
CVE-2026-14297The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.
High 8.7
In plain English
A high-severity out-of-bounds write in nRF Connect SDK from Nordic Semiconductor ASA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on the linker-assigned BSS layout of the specific firmware build, which may vary.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Nordic Semiconductor ASA | nRF Connect SDK | 2.2.0 – through 3.3.0 |
Weakness: CWE-787 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N