CVE-2026-47773

ArduinoBLE, the library that adds Bluetooth Low Energy connectivity to certain Arduino boards, contains a missing bounds check in the ATT layer write request handler in versions prior to 2.0.2. Any remote, unauthenticated BLE client within radio range can trigger the flaw by sending crafted ATT write requests, causing memory corruption in the ATTClass global object. Per the CVSS scoring, an attacker gains high integrity and availability impact (VC:N/VI:H/VA:H), meaning they can manipulate device state or crash the device, with no confidentiality impact indicated. Only devices running ArduinoBLE firmware in which one or more BLE characteristics are configured with the BLEEncryption property are affected. There is currently no known exploitation, no public proof of concept, and the issue is not listed in CISA's KEV catalog.

What to do: Update the ArduinoBLE library to version 2.0.2 or later, then recompile and redeploy affected sketches to devices. If upgrading is not immediately possible, remove the BLEEncryption property from writable characteristics, or restrict which clients can connect where the firmware allows it. Audit Arduino projects for use of BLECharacteristic configurations with BLEEncryption to identify affected deployments.