Buffer overflow in Apache Nuttx
CVE-2025-35003
Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bluetooth Stack (HCI and UART components) that may result in system crash, denial of service, or arbitrary code execution, after receiving maliciously crafted packets. NuttX's Bluetooth HCI/UART stack users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues. This issue affects Apache NuttX: from 7.25 before 12.9.0.
Vulnerability class: Buffer Overflow
EPSS: 0.013 (66.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Nuttx
- Apache Software Foundation Nuttx Rtos — versions 7.25
Weakness classification (CWE)
References
- security@apache.org (Exploit, Patch, patch, Issue Tracking)
- security@apache.org (vendor-advisory, Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
Frequently asked questions
- What is CVE-2025-35003?
- CVE-2025-35003 is a critical-severity vulnerability in Apache Nuttx, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.8/10. Published 2025-05-26.
- How severe is CVE-2025-35003?
- Critical severity. CVSS v3 base score is 9.8 out of 10.