CVE-2025-47869

Katalog CVE

CVSS 9.8 · Critical EPSS 0,74%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada apache nuttx. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache NuttX RTOS apps/exapmles/xmlrpc application. In this example application device stats structure that stored remotely provided parameters had hardcoded buffer size which could lead to buffer overflow. Structure members buffers were updated to valid size of CONFIG_XMLRPC_STRINGSIZE+1. This issue affects Apache NuttX RTOS users that may have used or base their code on example application as presented in releases from 6.22 before 12.9.0. Users of XMLRPC in Apache NuttX RTOS are advised to review their code for this pattern and update buffer sizes as presented in the version of the example in release 12.9.0.

Rincian

Terbit di NVD

16 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/306qcqyc3bpb2ozh015yxjo9kqs4jbvj advisory vendor
• http://www.openwall.com/lists/oss-security/2025/06/14/2 mailing list · advisory vendor
• https://github.com/apache/nuttx-apps/pull/3027 issue tracking · advisory pihak ketiga