CVE-2025-35003

Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bluetooth Stack (HCI and UART components) that may result in system crash, denial of service, or arbitrary code execution, after receiving maliciously crafted packets. NuttX's Bluetooth HCI/UART stack users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues. This issue affects Apache NuttX: from 7.25 before 12.9.0.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/nuttx/pull/16179	Exploit Issue Tracking Patch
https://lists.apache.org/thread/k4xzz3jhkx48zxw9vwmqrmm4hmg78vsj	Mailing List
http://www.openwall.com/lists/oss-security/2025/05/26/1	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:*

History

08 Jul 2025, 13:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-26 10:15

Updated : 2025-07-08 13:17

NVD link : CVE-2025-35003

Mitre link : CVE-2025-35003

CVE.ORG link : CVE-2025-35003

JSON object : View

Products Affected

apache

nuttx

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2025-35003", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-05-26T10:15:19.750", "references": [{"url": "https://github.com/apache/nuttx/pull/16179", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/k4xzz3jhkx48zxw9vwmqrmm4hmg78vsj", "tags": ["Mailing List"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/05/26/1", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bluetooth Stack (HCI and UART components) that may result in system crash, denial of service, or arbitrary code execution, after receiving maliciously crafted packets.\n\nNuttX's Bluetooth HCI/UART stack users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues.\n\nThis issue affects Apache NuttX: from 7.25 before 12.9.0."}, {"lang": "es", "value": "Se descubrieron vulnerabilidades de restricci\u00f3n incorrecta de operaciones dentro de los l\u00edmites de un b\u00fafer de memoria y desbordamiento de b\u00fafer basado en pila en la pila Bluetooth de Apache NuttX RTOS (componentes HCI y UART). Estas vulnerabilidades pueden provocar un bloqueo del sistema, una denegaci\u00f3n de servicio o la ejecuci\u00f3n de c\u00f3digo arbitrario tras recibir paquetes maliciosos. Se recomienda a los usuarios de la pila Bluetooth HCI/UART de NuttX que actualicen a la versi\u00f3n 12.9.0, que corrige los problemas de implementaci\u00f3n identificados. Este problema afecta a Apache NuttX desde la versi\u00f3n 7.25 hasta la 12.9.0."}], "lastModified": "2025-07-08T13:17:42.373", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "054E1F6D-1377-4794-923C-1C52AD39C83F", "versionEndExcluding": "12.9.0", "versionStartIncluding": "7.25"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}