CyberSecBulletin

Nordic Semiconductor ASA vulnerabilities

We track 2 vulnerabilities in Nordic Semiconductor ASA products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 7, 2026.

2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score

Latest Nordic Semiconductor ASA vulnerabilities

  • 8.7 High severity

    nRF Connect SDK: Out-of-bounds Write

    CVE-2026-14297Nordic Semiconductor ASA

    A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be pre

  • 7.5 High severity

    nRF54H20: Improper Verification of Cryptographic Signature

    CVE-2026-14296Nordic Semiconductor ASA

    When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slot without additional verification. The MCUboot in the bare (upstream) configuration assumes that if there is at least a