PatchTheCVECVE-2024-48984: An issue was discovered in MBed OS 6.16.0
CVE-2024-48984 is a critical-severity flaw (CVSS 9.8) affecting mbed os. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software dynamically determines the length of a list of reports by reading a byte from an input stream. It then fetches the length of the first report, uses it to calculate the beginning of the second report, etc. In doing this, it tracks the largest report so it can later allocate a buffer that fits every individual report (but only one at a time). It does not,
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 54%) |
| CISA exploited list | No |
| Weakness | CWE-120 |
| Published | 2024-11-20 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-48984?
mbed os: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2024-48984 being exploited?
CVE-2024-48984 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-48984 affect?
CVE-2024-48984 affects mbed os. Severity is critical (CVSS 9.8). An issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software dynamically determines the length of a list of reports by reading a byte from an input stream. It then fetches the length of the first report, use
How urgent is CVE-2024-48984?
Priority 51/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2024-22905 HIGH 7.0 MITIGATE Buffer Overflow vulnerability in ARM mbed-os v.6.17.0 allows a remote attacker to execute arbitrary code via a