CVE-2025-48769

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-48769", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2025-05-26T01:39:04.334Z", "datePublished": "2026-01-01T16:14:33.415Z", "dateUpdated": "2026-01-05T20:07:09.425Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache NuttX RTOS", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "12.11.0", "status": "affected", "version": "7.20", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Liu, Richard Jiayang <rjliu3@illinois.edu>"}, {"lang": "en", "type": "remediation developer", "value": "Liu, Richard Jiayang <rjliu3@illinois.edu>"}, {"lang": "en", "type": "coordinator", "value": "Tomek CEDRO <cederom@apache.org>"}, {"lang": "en", "type": "remediation reviewer", "value": "Xiang Xiao <xiaoxiang@apache.org>"}, {"lang": "en", "type": "remediation reviewer", "value": "Jiuzhu Dong <jiuzhudong@apache.org>"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in specific cases could cause unintended virtual filesystem rename/move operation results.</p><p>This issue affects Apache NuttX RTOS: from 7.20 before 12.11.0.</p><p>Users of virtual filesystem based services with write access especially when exposed over the network (i.e. FTP) are affected and recommended to upgrade to version 12.11.0 that fixes the issue.</p>"}], "value": "Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in specific cases could cause unintended virtual filesystem rename/move operation results.\n\nThis issue affects Apache NuttX RTOS: from 7.20 before 12.11.0.\n\nUsers of virtual filesystem based services with write access especially when exposed over the network (i.e. FTP) are affected and recommended to upgrade to version 12.11.0 that fixes the issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-01-01T16:14:33.415Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/nuttx/pull/16455"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/7m83v11ldfq7bvw72n9t5sccocczocjn"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache NuttX RTOS: fs/vfs/fs_rename: use after free", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/12/31/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-01T17:07:57.326Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-05T20:06:45.981815Z", "id": "CVE-2025-48769", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-05T20:07:09.425Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/12/31/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-01T17:07:57.326Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-48769", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-05T20:06:45.981815Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-05T20:07:04.084Z"}}], "cna": {"title": "Apache NuttX RTOS: fs/vfs/fs_rename: use after free", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Liu, Richard Jiayang <rjliu3@illinois.edu>"}, {"lang": "en", "type": "remediation developer", "value": "Liu, Richard Jiayang <rjliu3@illinois.edu>"}, {"lang": "en", "type": "coordinator", "value": "Tomek CEDRO <cederom@apache.org>"}, {"lang": "en", "type": "remediation reviewer", "value": "Xiang Xiao <xiaoxiang@apache.org>"}, {"lang": "en", "type": "remediation reviewer", "value": "Jiuzhu Dong <jiuzhudong@apache.org>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache NuttX RTOS", "versions": [{"status": "affected", "version": "7.20", "lessThan": "12.11.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/nuttx/pull/16455", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/7m83v11ldfq7bvw72n9t5sccocczocjn", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in specific cases could cause unintended virtual filesystem rename/move operation results.\n\nThis issue affects Apache NuttX RTOS: from 7.20 before 12.11.0.\n\nUsers of virtual filesystem based services with write access especially when exposed over the network (i.e. FTP) are affected and recommended to upgrade to version 12.11.0 that fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in specific cases could cause unintended virtual filesystem rename/move operation results.</p><p>This issue affects Apache NuttX RTOS: from 7.20 before 12.11.0.</p><p>Users of virtual filesystem based services with write access especially when exposed over the network (i.e. FTP) are affected and recommended to upgrade to version 12.11.0 that fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-01-01T16:14:33.415Z"}}}, "cveMetadata": {"cveId": "CVE-2025-48769", "state": "PUBLISHED", "dateUpdated": "2026-01-05T20:07:09.425Z", "dateReserved": "2025-05-26T01:39:04.334Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-01-01T16:14:33.415Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache NuttX RTOS", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "12.11.0", "status": "affected", "version": "7.20", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:*", "matchCriteriaId": "81ECDE8C-6BF7-4DFA-8054-18D43595BC63", "versionEndExcluding": "12.11.0", "versionStartIncluding": "7.20", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in specific cases could cause unintended virtual filesystem rename/move operation results.\n\nThis issue affects Apache NuttX RTOS: from 7.20 before 12.11.0.\n\nUsers of virtual filesystem based services with write access especially when exposed over the network (i.e. FTP) are affected and recommended to upgrade to version 12.11.0 that fixes the issue."}, {"lang": "es", "value": "Una vulnerabilidad Use After Free fue descubierta en el c\u00f3digo fs/vfs/fs_rename del RTOS Apache NuttX, que debido a la implementaci\u00f3n recursiva y al uso de un \u00fanico b\u00fafer por dos variables de puntero diferentes, permiti\u00f3 la reasignaci\u00f3n de un b\u00fafer de tama\u00f1o arbitrario proporcionado por el usuario y la escritura en el fragmento de memoria del heap previamente liberado, lo que en casos espec\u00edficos podr\u00eda causar resultados inesperados en las operaciones de renombrar/mover del sistema de archivos virtual.\n\nEste problema afecta a Apache NuttX RTOS: desde 7.20 antes de 12.11.0.\n\nLos usuarios de servicios basados en sistemas de archivos virtuales con acceso de escritura, especialmente cuando est\u00e1n expuestos a trav\u00e9s de la red (es decir, FTP), se ven afectados y se les recomienda actualizar a la versi\u00f3n 12.11.0 que corrige el problema."}], "id": "CVE-2025-48769", "lastModified": "2026-10-07T11:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-48769", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-05T20:06:45.981815Z", "version": "2.0.3"}}]}, "published": "2026-01-01T17:15:43.243", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking"], "url": "https://github.com/apache/nuttx/pull/16455"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/7m83v11ldfq7bvw72n9t5sccocczocjn"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2025/12/31/11"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"created": "2026-01-05T10:14:51.234621+00:00", "updated": "2026-01-05T10:14:51.234647+00:00", "vendors": ["apache", "apache$PRODUCT$nuttx"]}