CVE-2025-35003

CRITICAL

Apache NuttX 7.25-12.9.0 - Stack-based Buffer Overflow in Bluetooth HCI/UART Stack

Title source: llm
STIX 2.1

Description

Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bluetooth Stack (HCI and UART components) that may result in system crash, denial of service, or arbitrary code execution, after receiving maliciously crafted packets. NuttX's Bluetooth HCI/UART stack users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues. This issue affects Apache NuttX: from 7.25 before 12.9.0.

References (3)

Core 3

Scores

CVSS v3 9.8
EPSS 0.0053
EPSS Percentile 67.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-119 CWE-121
Status published
Products (1)
apache/nuttx 7.25 - 12.9.0
Published May 26, 2025
Tracked Since Feb 18, 2026