PT-2025-25489 · Apache · Apache Nuttx

Chánh Phạm · CVE-2025-47868 · Published 2025-06-14 · Updated 2025-06-16

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache NuttX versions 6.9 through 12.9.0

Description An Out-of-bounds Write resulting in a possible Heap-based Buffer Overflow issue was discovered in the tools/bdf-converter font conversion utility, which is part of the Apache NuttX RTOS repository. This utility is optional and not part of the NuttX RTOS or Applications runtime. However, active users of bdf-converter may be affected when the tool is exposed to external user data.

Recommendations For Apache NuttX versions 6.9 through 12.9.0, upgrade to version 12.9.0 to fix the issue.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-122

CWE-787

Related Identifiers

BDU:2025-08202

CVE-2025-47868

Affected Products

Apache Nuttx

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47868.json · Exploit
• https://github.com/apache/nuttx/pull/16000 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-47868 · Security Note
• https://bdu.fstec.ru/vul/2025-08202 · Security Note
• http://openwall.com/lists/oss-security/2025/06/14/1 · Vendor Advisory
• https://lists.apache.org/thread/p4o2lcqgspx3ws1n2p4wmoqbqow1w1pw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47868 · Vendor Advisory
• https://twitter.com/transilienceai/status/1934101617621733727 · Twitter Post
• https://t.me/cvenotify/125762 · Telegram Post
• https://openwall.com/lists/oss-security/2025/06/14/1 · Note
• https://t.me/latest_high_impact_cve/2677 · Telegram Post
• https://twitter.com/oss_security/status/1934032353711554950 · Twitter Post
• https://twitter.com/CVEnew/status/1934570406675186016 · Twitter Post
• https://t.me/cvetracker/26301 · Telegram Post