Heap Overflow Vulnerability in NeKernal Operating System Stack

CVE-2025-48990

What is CVE-2025-48990?

NeKernal, a free and open-source operating system stack, is affected by a heap overflow vulnerability present in version 0.0.2. The issue arises from the function rt_copy_memory, which improperly writes an extra null terminator beyond the allocated buffer when the specified length matches the buffer size, leading to a one-byte overflow. The development team has implemented a patch in commit fb7b7f658327f659c6a6da1af151cb389c2ca4ee, which addresses this flaw by removing the overflow-inducing line without changing existing function signatures or adding boundary checks. Users of NeKernal are advised to review their deployments and apply the appropriate updates to mitigate this risk.

References