CVE-2025-48769

{"id": "CVE-2025-48769", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-48769", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-05T20:06:45.981815Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache NuttX RTOS", "versions": [{"status": "affected", "version": "7.20", "lessThan": "12.11.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-01T17:15:43.243", "references": [{"url": "https://github.com/apache/nuttx/pull/16455", "tags": ["Issue Tracking"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/7m83v11ldfq7bvw72n9t5sccocczocjn", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/12/31/11", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in specific cases could cause unintended virtual filesystem rename/move operation results.\n\nThis issue affects Apache NuttX RTOS: from 7.20 before 12.11.0.\n\nUsers of virtual filesystem based services with write access especially when exposed over the network (i.e. FTP) are affected and recommended to upgrade to version 12.11.0 that fixes the issue."}, {"lang": "es", "value": "Una vulnerabilidad Use After Free fue descubierta en el c\u00f3digo fs/vfs/fs_rename del RTOS Apache NuttX, que debido a la implementaci\u00f3n recursiva y al uso de un \u00fanico b\u00fafer por dos variables de puntero diferentes, permiti\u00f3 la reasignaci\u00f3n de un b\u00fafer de tama\u00f1o arbitrario proporcionado por el usuario y la escritura en el fragmento de memoria del heap previamente liberado, lo que en casos espec\u00edficos podr\u00eda causar resultados inesperados en las operaciones de renombrar/mover del sistema de archivos virtual.\n\nEste problema afecta a Apache NuttX RTOS: desde 7.20 antes de 12.11.0.\n\nLos usuarios de servicios basados en sistemas de archivos virtuales con acceso de escritura, especialmente cuando est\u00e1n expuestos a trav\u00e9s de la red (es decir, FTP), se ven afectados y se les recomienda actualizar a la versi\u00f3n 12.11.0 que corrige el problema."}], "lastModified": "2026-10-07T11:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81ECDE8C-6BF7-4DFA-8054-18D43595BC63", "versionEndExcluding": "12.11.0", "versionStartIncluding": "7.20"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}