Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Apache NuttX RTOS virtual file rename can corrupt data

CVE-2025-48769 · published 10 months ago
Summary

The Apache NuttX real‑time operating system versions before 12.11.0 have a flaw in the code that handles renaming files in its virtual filesystem. An attacker who can write to the system, for example via network services like FTP, could cause the system to write over memory that has already been released, leading to unexpected file moves or data corruption. Upgrade to version 12.11.0 or later to resolve the issue.

What to do
  • Update apache nuttx to version 12.11.0 or later.
Affected software
VendorProductAffected versions
apache nuttx >= 7.20, < 12.11.0
cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:*
Original advisory text
Apache NuttX RTOS: fs/vfs/fs_rename: use after free
Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in specific cases could cause unintended virtual filesystem rename/move operation results.

This issue affects Apache NuttX RTOS: from 7.20 before 12.11.0.

Users of virtual filesystem based services with write access especially when exposed over the network (i.e. FTP) are affected and recommended to upgrade to version 12.11.0 that fixes the issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published1 Jan 2026
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-48769 · NVD
CVE-2025-48769 · OSV
Track software like this
Free during beta