Use After Free Vulnerability in Apache NuttX RTOS

CVE-2025-48769

What is CVE-2025-48769?

A Use After Free vulnerability has been identified in the Apache NuttX RTOS, specifically within the fs/vfs/fs_rename code. This vulnerability arises from a recursive implementation that utilizes a single buffer with two different pointer variables, allowing for arbitrary user-provided size buffer reallocation. Consequently, this mismanagement can lead to unintended results during virtual filesystem rename or move operations when the free heap chunk is accessed. Users, especially those operating virtual filesystem services with write access over network interfaces like FTP, are advised to upgrade to version 12.11.0, which addresses this critical issue.

References