PT-2025-54474 · Apache · Apache Nuttx Rtos

Published 2025-12-31 · Updated 2026-01-06 · CVE-2025-48769

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache NuttX RTOS versions 7.20 through 12.10

Description A Use After Free issue was identified in the fs/vfs/fs rename code of the Apache NuttX RTOS. The issue stems from a recursive implementation and the use of a single buffer by two different pointer variables, which allowed for arbitrary user-provided size buffer reallocation and writing to a previously freed heap chunk. In certain scenarios, this could lead to unintended virtual filesystem rename or move operation results. Users of virtual filesystem-based services with write access, particularly when exposed over a network such as FTP, are affected.

Recommendations Upgrade to version 12.11.0 to resolve this issue.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-00347

CVE-2025-48769

Affected Products

Apache Nuttx Rtos

References · 15

• https://github.com/apache/nuttx/pull/16455 · Patch
• https://bdu.fstec.ru/vul/2026-00347 · Security Note
• https://lists.apache.org/thread/7m83v11ldfq7bvw72n9t5sccocczocjn · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48769 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48769 · Security Note
• https://t.me/cveNotify/147833 · Telegram Post
• https://twitter.com/threatcluster/status/2007029198129336614 · Twitter Post
• https://t.me/cveNotify/147443 · Telegram Post
• https://twitter.com/oss_security/status/2006468789689528400 · Twitter Post
• https://t.me/CVEtracker/41181 · Telegram Post
• https://twitter.com/NewsNerdie/status/2006998917007749524 · Twitter Post
• https://twitter.com/CVEnew/status/2006861506525171884 · Twitter Post
• https://t.me/cveNotify/147762 · Telegram Post
• http://openwall.com/lists/oss-security/2025/12/31/11 · Note
• https://twitter.com/VulmonFeeds/status/2006783715855188089 · Twitter Post