CVE-2025-35003

Description

Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bluetooth Stack (HCI and UART components) that may result in system crash, denial of service, or arbitrary code execution, after receiving maliciously crafted packets. NuttX's Bluetooth HCI/UART stack users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues. This issue affects Apache NuttX: from 7.25 before 12.9.0.

PUBLISHED Reserved 2025-04-15 | Published 2025-05-26 | Updated 2026-02-26 | Assigner apache

Problem types

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-121 Stack-based Buffer Overflow

Product status

Credits

Chongqing Lei <leicq@seu.edu.cn> reporter

Zhen Ling <zhenling@seu.edu.cn> reporter

Chongqing Lei <leicq@seu.edu.cn> remediation developer

Tomek CEDRO <tomek@cedro.info> coordinator

References

www.openwall.com/lists/oss-security/2025/05/26/1

github.com/apache/nuttx/pull/16179 patch

lists.apache.org/thread/k4xzz3jhkx48zxw9vwmqrmm4hmg78vsj vendor-advisory

cve.org (CVE-2025-35003)

nvd.nist.gov (CVE-2025-35003)

Download JSON