CVE-2025-35003

Katalog CVE

CVSS 9.8 · Critical EPSS 1,5%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada apache nuttx. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bluetooth Stack (HCI and UART components) that may result in system crash, denial of service, or arbitrary code execution, after receiving maliciously crafted packets. NuttX's Bluetooth HCI/UART stack users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues. This issue affects Apache NuttX: from 7.25 before 12.9.0.

Rincian

Terbit di NVD

26 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 72,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/apache/nuttx/pull/16179 exploit · issue tracking · patch
• https://lists.apache.org/thread/k4xzz3jhkx48zxw9vwmqrmm4hmg78vsj mailing list
• http://www.openwall.com/lists/oss-security/2025/05/26/1 mailing list