PT-2025-25489 · Apache · Apache Nuttx

Chánh Phạm · Published 2025-06-14 · Updated 2025-06-16 · CVE-2025-47868

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache NuttX versions 6.9 through 12.9.0

Description An Out-of-bounds Write resulting in a possible Heap-based Buffer Overflow issue was discovered in the tools/bdf-converter font conversion utility, which is part of the Apache NuttX RTOS repository. This utility is optional and not part of the NuttX RTOS or Applications runtime. However, active users of bdf-converter may be affected when the tool is exposed to external user data.

Recommendations For Apache NuttX versions 6.9 through 12.9.0, upgrade to version 12.9.0 to fix the issue.

Fix

Memory Corruption

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

CWE-119

Related Identifiers

BDU:2025-08202

CVE-2025-47868

Affected Products

Apache Nuttx

References · 13

• https://github.com/apache/nuttx/pull/16000 · Patch
• https://lists.apache.org/thread/p4o2lcqgspx3ws1n2p4wmoqbqow1w1pw · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08202 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-47868 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47868 · Vendor Advisory
• http://openwall.com/lists/oss-security/2025/06/14/1 · Vendor Advisory
• https://openwall.com/lists/oss-security/2025/06/14/1 · Note
• https://t.me/cvenotify/125762 · Telegram Post
• https://t.me/cvetracker/26301 · Telegram Post
• https://t.me/latest_high_impact_cve/2677 · Telegram Post
• https://twitter.com/oss_security/status/1934032353711554950 · Twitter Post
• https://twitter.com/CVEnew/status/1934570406675186016 · Twitter Post
• https://twitter.com/transilienceai/status/1934101617621733727 · Twitter Post