PatchTheCVECVE-2024-0240: A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when se
CVE-2024-0240 is a medium-severity flaw (CVSS 6.5) affecting gecko software development kit. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when sending notifications to multiple clients, this results in all Bluetooth operations, such as advertising and scanning, to stop.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 70%) |
| CISA exploited list | No |
| Weakness | CWE-401 |
| Published | 2024-02-15 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-0240?
gecko software development kit: upgrade to 4.3.0. Exact commands for each OS are on this page.
Is CVE-2024-0240 being exploited?
CVE-2024-0240 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-0240 affect?
CVE-2024-0240 affects gecko software development kit. Severity is medium (CVSS 6.5). A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when sending notifications to multiple clients, this results in all Bluetooth operations, such as advertising and scanning, to stop.
How urgent is CVE-2024-0240?
Priority 30/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2024-22473 MEDIUM 6.8 UPGRADE TRNG is used before initialization by ECDSA signing driver when exiting EM2/EM3 on Virtual Secure Vault (VSE)
- CVE-2023-6387 HIGH 7.5 UPGRADE A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may r
- CVE-2023-5138 MEDIUM 6.8 UPGRADE Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx3
- CVE-2023-4280 CRITICAL 9.3 UPGRADE An unvalidated input in Silicon Labs TrustZone implementation in v4.3.x and earlier of the Gecko SDK allows an
- CVE-2023-4020 CRITICAL 9.0 UPGRADE An unvalidated input in a library function responsible for communicating between secure and non-secure memory