Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.

published 2025-05-26 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-16334

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.6%; EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits: 0; none known

Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities were discovered in Apache NuttX RTOS Bluetooth Stack (HCI and UART components) that may result in system crash, denial of service, or arbitrary code execution, after receiving maliciously crafted packets.

NuttX's Bluetooth HCI/UART stack users are advised to upgrade to version 12.9.0, which fixes the identified implementation issues.

This issue affects Apache NuttX: from 7.25 before 12.9.0.

Patch / fix

fixed in 1 links 1

Apache Software Foundation Apache NuttX RTOS 12.9.0

github.com/apache/nuttx#16179 pull request

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 17 mo ago (2025-05-28)

Exploit prediction

1.61% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/apache/nuttx/pull/16179 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Software Foundation Apache NuttX RTOS

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-121 Stack-based Buffer Overflow

References

github.com /apache/nuttx/pull/16179
patch, exploit, issue-tracking
lists.apache.org /thread/k4xzz3jhkx48zxw9vwmqrmm4hmg78vsj
vendor-advisory, mailing-list
openwall.com /lists/oss-security/2025/05/26/1
mailing-list

Sources

CVE List CVE-2025-35003
NVD CVE-2025-35003

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary