CVE-2019-13916

An issue was discovered in Cypress (formerly Broadcom) WICED Studio 6.2 CYW20735B1 and CYW20819A1. As a Bluetooth Low Energy (BLE) packet is received, it is copied into a Heap (ThreadX Block) buffer. The buffer allocated in dhmulp_getRxBuffer is four bytes too small to hold the maximum of 255 bytes plus headers. It is possible to corrupt a pointer in the linked list holding the free buffers of the g_mm_BLEDeviceToHostPool Block pool. This pointer can be fully controlled by overflowing with 3 bytes of packet data and the first byte of the packet CRC checksum. The checksum can be freely chosen by adapting the packet data accordingly. An attacker might be able to allocate the overwritten address as a receive buffer resulting in a write-what-where condition. This is fixed in BT SDK2.4 and BT SDK2.45.

• CWE-787

• https://community.cypress.com/thread/53681Permissions Required, Vendor Advisory
• https://github.com/seemoo-lab/frankenstein/blob/master/doc/CVE_2019_13916.mdExploit, Third Party Advisory
• https://community.cypress.com/thread/53681Permissions Required, Vendor Advisory
• https://github.com/seemoo-lab/frankenstein/blob/master/doc/CVE_2019_13916.mdExploit, Third Party Advisory

Published

Apr 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1387An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, …8.8
• CVE-2019-1388An elevation of privilege vulnerability exists in the Window…7.8
• CVE-2019-1389A remote code execution vulnerability exists when Windows Hy…8.4
• CVE-2019-1390A remote code execution vulnerability exists in the way that…7.5
• CVE-2019-1391A denial of service vulnerability exists when Windows improp…5.5
• CVE-2019-13915b3log Wide before 1.6.0 allows three types of attacks to acc…
• CVE-2019-13917Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code …
• CVE-2019-13918A vulnerability has been identified in SINEMA Remote Connect…9.8
• CVE-2019-13919A vulnerability has been identified in SINEMA Remote Connect…4.3
• CVE-2019-1392An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2019-13920A vulnerability has been identified in SINEMA Remote Connect…4.3
• CVE-2019-13921A vulnerability has been identified in SIMATIC WinAC RTX (F)…7.5