Skip to content
OpenAdvisories

Vendor

Nordic Semiconductor ASA

3 known vulnerabilities.

Products

nRF5340 1 nRF54H20 1 nRF Connect SDK 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-14297

    The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.

    A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be pr…

    Nordic Semiconductor ASA nRF Connect SDK
  • High 7.5
    CVE-2026-14296

    nRF54H20: MCUBoot can be tricked to executing unauthenticated code

    When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slot without additional verification. The MCUboot in the bare (upstream) configuration assumes that if there is at least …

    Nordic Semiconductor ASA nRF54H20