Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bluetooth Stack (HCI and UART components) that may result in system crash, denial of service, or arbitrary code execution, after receiving maliciously crafted packets.
NuttX's Bluetooth HCI/UART stack users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues.
This issue affects Apache NuttX: from 7.25 before 12.9.0.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2025/05/26/1 | Mailing List |
| https://github.com/apache/nuttx/pull/16179 | Exploit Issue Tracking Patch |
| https://lists.apache.org/thread/k4xzz3jhkx48zxw9vwmqrmm4hmg78vsj | Mailing List |
Configurations
History
08 Jul 2025, 13:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2025/05/26/1 - Mailing List | |
| References | () https://lists.apache.org/thread/k4xzz3jhkx48zxw9vwmqrmm4hmg78vsj - Mailing List | |
| References | () https://github.com/apache/nuttx/pull/16179 - Exploit, Issue Tracking, Patch | |
| CPE | cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:* | |
| First Time |
Apache nuttx
Apache |
26 May 2025, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-26 10:15
Updated : 2025-07-08 13:17
NVD link : CVE-2025-35003
Mitre link : CVE-2025-35003
JSON object : View
Products Affected
apache
- nuttx
CWE
No CWE.