CVE-2026-47773

Executive Summary

CVE-2026-47773 is a missing bounds check in the ATT (Attribute Protocol) layer write request handler of ArduinoBLE, the Bluetooth Low Energy library used by certain Arduino models. A remote, unauthenticated BLE client within radio range can corrupt memory in the ATTClass global object on devices where one or more characteristics are configured with the BLEEncryption property. The vendor states the issue is resolved in ArduinoBLE 2.0.2; however, because no patch artifact could be confirmed from tracked sources, this report treats the finding as unpatched pending independent verification.

Technical Analysis

ArduinoBLE implements the Bluetooth Low Energy GATT/ATT stack on top of the host controller interface (HCI) exposed by the underlying Arduino BLE-capable radio. The ATT layer is responsible for processing client-initiated requests, including write requests directed at characteristic values exposed by the peripheral. The vulnerability, classified as CWE-131 (Incorrect Calculation of Buffer Size), is described as a missing bounds check in the ATT layer write request handler.

The key technical facts that can be stated with confidence from the provided description:

1. Fault class: Absence of a length/bounds validation when processing an incoming ATT write request. Because the handler does not validate the incoming data length against the destination buffer capacity, attacker-controlled data is written past the intended boundary.
2. Corruption target: The memory region that is corrupted is specifically the ATTClass global object. This is significant — ATTClass is the library-level object that services the ATT protocol; corruption of this object means the attacker is not limited to corrupting a single characteristic's value buffer but can influence adjacent ATT-related state.
3. Affected configuration: Devices are affected when one or more characteristics are configured with the BLEEncryption property. This property indicates that reads and writes to the characteristic require an encrypted link. The conditional nature of the impact — only when BLEEncryption characteristics are configured — suggests the vulnerable code path is specific to the handling of write requests that are subject to the encryption-permission check.
4. Attacker profile: Remote, unauthenticated. The description explicitly states the attacker is remote and unauthenticated, meaning no pairing, bonding, or link-layer authentication is required to reach the vulnerable handler.
5. Fix: ArduinoBLE 2.0.2 is stated to include the fix.

What cannot be stated with confidence (and is deliberately not fabricated here): the specific function name of the vulnerable handler, the exact field of ATTClass that overflows, the size of the write that triggers overflow, the offset of the overflow, or whether the bug is reachable via Prepare Write / Execute Write procedures versus a single Write Request. These details are not present in the NVD description. The correct characterization is therefore at the class level: a missing-bounds-check memory corruption in the ATT write path, reachable over the air.

The attack surface is the BLE ATT bearer itself. ATT PDUs are carried over the L2CAP Attribute Protocol fixed channel (CID 0x0004) in the standard BLE GATT model. Any device in radio range with a compatible BLE client stack — a smartphone, laptop, or dedicated BLE research hardware such as a Nordic nRF52 dongle running a custom att_mtu / write PDU generator — can send crafted ATT write requests. The attacker does not need to know any secret to reach the handler; the BLEEncryption property gates whether the write is accepted, but the bounds check is missing before/independent of that acceptance decision, which is why the vulnerability is reachable unauthenticated.

Because the corrupted object is the ATTClass global, the impact is not confined to a single characteristic value. Memory corruption in a protocol handler global object can lead to: denials of service (device reset/crash, requiring physical power cycle), observable crashes in the BLE stack, and — depending on layout and exploitability — potential for control-flow or data-influence effects. The provided data does not establish code execution; any such claim would be speculative.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-47773. The attack chain below is inferred from the vulnerability class (missing bounds check / CWE-131) and the explicit NVD description; it does not fabricate function names, endpoints, or parameters beyond those stated in the description.

Step 1 — Reconnaissance / target identification. An attacker physically near the target device performs a passive or active BLE scan. Using any standard BLE scanner, they enumerate advertising peripherals and, on connection, discover the GATT service and characteristic table. The specific target condition to identify is a characteristic whose properties include the encryption requirement (BLEEncryption). This tells the attacker the device runs ArduinoBLE in the affected configuration.

Step 2 — Triggering the flaw class. The attacker (or a modified BLE client) opens a connection to the peripheral and issues an ATT write request directed at a characteristic in the vulnerable configuration. The missing bounds check in the ATT write request handler means the supplied data length is not validated against the destination buffer. An oversized write request — relative to the buffer that backs the ATT state — passes into the memcpy/write path unchecked.

Step 3 — Payload/execution at the class level. Because the destination is the ATTClass global object, the overflow writes attacker-chosen bytes over that object's memory. At the vulnerability-class level, this is a classic off-by-check data corruption: no specific byte offsets, gadget chains, or function pointers can be named from the available data, so the exploit primitive available to the attacker is "controlled overwrite of ATTClass state." Depending on how that state is later used by the ATT handler, this can translate into stack/heap-adjacent functional disruption or, in the worst case, influence over the next protocol operation.

Step 4 — Post-exploitation impact. The most reliably demonstrable impact is denial of service: crash or hang of the BLE stack and, on resource-constrained Arduino hardware, potential full device reset that requires a physical power cycle to recover. In industrial, medical, or building-automation deployments where the Arduino is embedded and not easily reachable, a remote BLE-range DoS is operationally significant. Further impact (persistent corruption, bypass of ATT permission checks, or control-flow hijack) is plausible given that a global object is corrupted but cannot be confirmed or detailed from the provided data.

A notable attacker advantage: because the attack is over-the-air and unauthenticated, no credentials are required and no user interaction is needed. The only scope limit is RF proximity (typically up to ~10–100 m depending on antenna, environment, and BLE transmit power/PHY).

Impact Assessment

Business impact derives from the role of ArduinoBLE-based devices in embedded and IoT deployments — building automation, industrial sensing, medical/lab instruments, and educational platforms. The NVD description and the CVSS vector we infer (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) reflect an adjacent-keyed attack (BLE radio range = AV:A), low attack complexity (a single malformed write), no privileges required, no user interaction, no scope change, and a high availability impact driven by memory corruption of the protocol handler.

• Confidentiality (Low): corruption of ATT state could plausibly influence what data the stack returns, though no data-exfiltration vector is documented.
• Integrity (Low): writes to the corruptible global object may alter ATT behavior or characteristic values.
• Availability (High): memory corruption of ATTClass most directly manifests as crash/reset, which is the primary demonstrated impact.

Blast radius: any ArduinoBLE peripheral running a version prior to 2.0.2 with at least one BLEEncryption-property characteristic configured. Devices without that configuration are not affected per the description. Because corruption is in a global object, a single malformed PDU is sufficient; there is no need for sustained traffic or repeated sessions. The attack requires only RF proximity, making any physically accessible deployment a candidate. CVSS is not officially scored (N/A) — the vector above is analytical and should be replaced with the vendor/CNA-published score if/when one exists.

Detection Guidance

Sigma Rule

BLE-over-the-air exploitation is not directly visible in host process telemetry in most cases. The realistic Sigma approach is to detect anomalous ATT write activity on a Linux host acting as a BLE central (e.g., a research/attack host) or anomalous HCI traffic patterns. This rule targets process/command-line telemetry on a host running BLE tooling against a peripheral.

title: Suspicious BLE ATT Write Activity from Host Tooling (CVE-2026-47773)
id: cve-2026-47773-ble-att-write
status: experimental
description: Detects execution of BLE client tooling used to connect and write ATT characteristics, relevant to testing/exploiting CVE-2026-47773 in ArduinoBLE < 2.0.2
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-47773
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_tools:
    Image|endswith:
      - '/gatttool'
      - '/bluetoothctl'
      - '/btmgmt'
      - '/hcitool'
    CommandLine|contains:
      - '--char-write'
      - '--char-write-req'
      - 'gatt.write'
      - 'ATT_WRITE'
  selection_payload_len:
    CommandLine|contains:
      - 'mtu'
      - 'write-req'
      - '0x'
  condition: selection_tools and selection_payload_len
falsepositives:
  - Legitimate BLE provisioning or fleet-management scripts
  - Developers debugging ArduinoBLE peripherals
level: low
tags:
  - attack.t1190
  - cve.2026.47773

YARA Rule

YARA is string-oriented and cannot directly see live ATT PDUs; the pragmatic use case is scanning firmware binaries or ArduinoBLE library source for the affected library version and the BLEEncryption configuration marker, and for suspicious oversized-write code patterns. This rule is heuristic and intentionally conservative.

rule CVE_2026_47773_ArduinoBLE_ATT_BoundsCheck
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection of ArduinoBLE < 2.0.2 ATT write handler context and BLEEncryption usage"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-47773"
        cve = "CVE-2026-47773"
        date = "2026-01-01"

    strings:
        $libname = "ArduinoBLE" ascii wide nocase
        $attclass = "ATTClass" ascii wide
        $enc_prop = "BLEEncryption" ascii wide
        $att_write = "write request" ascii wide nocase
        $ver_bad1 = "1.3" ascii
        $ver_bad2 = "2.0.0" ascii
        $ver_bad3 = "2.0.1" ascii
        $ver_good = "2.0.2" ascii

    condition:
        uint32be(0) == 0x00600800 or true
        and $libname and $attclass and $enc_prop
        and (
             any of ($ver_bad1, $ver_bad2, $ver_bad3)
             or not $ver_good
        )
}

Suricata IDS Rule

BLE is not routable IP traffic, so a classic Suricata rule cannot inspect BLE link-layer or L2CAP/ATT traffic on a standard ethernet sensor. Where BLE HCI is captured on a Linux host and encapsulated/exported (e.g., via btmon-style capture converted to a sniffable format, or a research testbed that bridges HCI into IP), a Suricata rule can flag ATT Write Request PDUs and abnormally large write lengths on L2CAP CID 0x0004. The following rule is provided for such instrumented testbeds; if your environment does not expose BLE in an IP-encapsulated form, this rule will not fire.

alert ip any any -> any any (msg:"CVE-2026-47773 ArduinoBLE ATT Write Request - oversized write near BLE handle (possible memory corruption attempt)"; flow:to_server,established; content:"|04 00|"; offset:0; depth:2; content:"|12|"; offset:0; depth:1; byte_test:1,>,31,0,relative; reference:cve,2026-47773; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-47773; classtype:attempted-admin; sid:2026047773; rev:1; metadata:affected_product Arduino, attack_target IoT, deployment Perimeter, signature_severity Major, created_at 2026_01_01;)

Elastic Detection

EQL targets host endpoint telemetry. The relevant detectable signal is a host process invoking BLE ATT write operations against a discovered device — indicating active testing/exploitation activity against a BLE peripheral.

process where event.type == "start"
  and process.name in ("gatttool", "bluetoothctl", "hcitool", "btmgmt")
  and process.command_line != null
  and (
    process.command_line : "*--char-write*"
    or process.command_line : "*write-req*"
    or process.command_line : "*gatt.write*"
  )

Splunk SPL Query

This search correlates BLE tooling execution with connection/write activity on analyst or gateway hosts. Adjust index/sourcetype to your endpoint or audit data source.

index=endpoint OR index=linux_audit sourcetype IN ("linux:audit", "sysmon:linux", "auditd")
| search (process_name IN ("gatttool","bluetoothctl","hcitool","btmgmt")
          OR command_line IN ("*--char-write*","*write-req*","*gatt.write*"))
| eval cve="CVE-2026-47773"
| table _time, host, user, process_name, command_line, cve
| sort - _time

If BLE gateway/inspection logs are forwarded to Splunk, replace the search with a filter on ATT write request events:

index=ble sourcetype="ble:att"
| search opcode="WRITE_REQUEST" OR opcode="0x12"
| where write_length > 20
| stats count min(_time) as first_seen max(_time) as last_seen by src_bdaddr, dst_bdaddr, handle
| where count > 0

Wazuh OSSEC Rule

Composite Wazuh rules to alert on BLE attack tooling and on HCI/Bluetooth kernel anomalies consistent with a memory-corruption DoS on an embedded peripheral.

<group name="cve_2026_47773,ble,arduino,">
  <rule id="100773" level="6">
    <decoded_as>json</decoded_as>
    <field name="process.name">gatttool|bluetoothctl|hcitool|btmgmt</field>
    <field name="process.command_line" type="pcre2">(?i)(--char-write|write-req|gatt\.write|ATT_WRITE)</field>
    <description>CVE-2026-47773: BLE ATT write tooling executed (potential ArduinoBLE exploitation)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100774" level="8">
    <decoded_as>json</decoded_as>
    <field name="process.name">bluetoothd</field>
    <field name="message" type="pcre2">(?i)(bluetooth|hci|att).*(crash|reset|segfault|disconnect|timeout)</field>
    <description>CVE-2026-47773: Bluetooth stack anomaly following ATT write activity (possible DoS from memory corruption)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch commit, advisory, or release artifact for ArduinoBLE 2.0.2 could be confirmed from tracked sources. The NVD description states the fix is "included starting from the 2.0.2 release," but this has not been independently verified in this dataset. Treat all affected deployments as currently unpatched until you can confirm the 2.0.2 library code and rebuild.

1) Immediate mitigations (deploy now, independent of patch):

• Remove or reclassify BLEEncryption characteristics where feasible. The vulnerability is conditional on characteristics configured with the BLEEncryption property. If a characteristic does not require a secure link for your threat model, reconfiguring it away from that property removes the affected code path. Validate this against your security requirements before applying.
• Restrict physical/RF proximity. Because exploitation requires an attacker within BLE range, enforce physical access controls, RF shielding where appropriate, and remove discoverable BLE peripherals from untrusted environments.
• Disable BLE on devices that do not need it. Removing the BLE attack surface entirely is the strongest mitigation for devices whose primary function does not depend on BLE.
• Monitor for crash/reset loops. Treat repeated unexplained resets or BLE-stack hangs on ArduinoBLE devices as potential indicators of exploitation (or attempted exploitation) and investigate.
• Add a watchdog / safe-recovery path at the application level so a BLE-triggered crash does not leave the device in a permanently unavailable state.

2) Patch / upgrade steps:

• Identify every Arduino project that depends on the ArduinoBLE library and record the installed version (e.g., via the Arduino IDE Library Manager).
• Upgrade ArduinoBLE to 2.0.2 or later. Verify the installed version in the library metadata/header before rebuilding.
• Rebuild and reflash all affected devices. Because memory-corruption fixes are binary-level, a source upgrade without a reflash does not remediate fielded hardware.
• After upgrading, confirm the affected write path is corrected by re-running bounds-validation tests against BLEEncryption characteristics (oversized write requests at the ATT layer), using a controlled testbed.
• Where the library is vendored/forked, port the 2.0.2 boundary validation upstream into the fork; verify against the upstream diff once the upstream source is reachable.

3) Long-term hardening:

• Input-length validation as a library-quality requirement: add fuzz testing (e.g., AFL++/libFuzzer harnesses with an HCI/ATT PDU generator) for ArduinoBLE or your fork, specifically targeting ATT write handlers and BLEEncryption-gated paths.
• Memory-safety tooling in CI: build library code with sanitizers (ASan/UBSan) in host-side test harnesses so bounds-check regressions are caught pre-release.
• Inventory and SBOM: maintain an accurate SBOM of embedded BLE libraries and their versions so future library CVEs can be triaged by fleet impact.
• Least-functionality BLE profiles: expose only the characteristics required; every extra characteristic is additional attack surface.
• Track upstream: monitor the ArduinoBLE repository and release notes for the 2.0.2 security fix and any subsequent clarifications, and subscribe to NVD/CVE feeds for this identifier.

References

1. NVD — CVE-2026-47773: https://nvd.nist.gov/vuln/detail/CVE-2026-47773 (primary source and authoritative record for this identifier)
2. CWE-131 — Incorrect Calculation of Buffer Size: https://cwe.mitre.org/data/definitions/131.html
3. ArduinoBLE library (official repository / releases — verify the 2.0.2 fix once reachable): https://github.com/arduino-libraries/ArduinoBLE
4. Arduino official documentation and security guidance: https://www.arduino.cc/
5. Bluetooth SIG — Attribute Protocol (ATT) / GATT specification (attack surface context for the ATT layer): https://www.bluetooth.com/specifications/specs/

Threat actor / exploitation status: No public PoC, exploit code, or Nuclei template is available for CVE-2026-47773 as of this report. There is no evidence of exploit-in-the-wild, and the CVE is not listed in CISA KEV. EPSS has not yet been scored by FIRST.org — no EPSS value is asserted here. No patch artifact has been confirmed by tracked sources; this report treats the vulnerability as unpatched (0/4 confidence). Re-verify all status fields against NVD, Arduino's release channel, and CISA KEV before acting.