PatchTheCVEnuttx vulnerabilities and fixes
Recent CVEs affecting nuttx, with upgrade or downgrade steps. 10 tracked.
nuttx has 10 tracked vulnerabilities, 7 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-01-01. Highest priority: CVE-2025-35003 (score 71/100).
- CVE-2025-48769 HIGH 8.1 UPGRADE Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recurs
- CVE-2025-48768 MEDIUM 6.5 UPGRADE Release of Invalid Pointer or Reference vulnerability was discovered in fs/inode/fs_inoderemove code of the Ap
- CVE-2025-47869 CRITICAL 9.8 UPGRADE Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache
- CVE-2025-47868 CRITICAL 9.8 UPGRADE Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf
- CVE-2025-35003 CRITICAL 9.8 UPGRADE Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulner
- CVE-2021-26461 CRITICAL 9.8 UPGRADE Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and m
- CVE-2020-1939 CRITICAL 9.8 UPGRADE The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various o
- CVE-2020-17529 CRITICAL 9.8 UPGRADE Out-of-bounds Write vulnerability in TCP Stack of Apache NuttX (incubating) versions up to and including 9.1.0
- CVE-2020-17528 CRITICAL 9.1 UPGRADE Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0
- CVE-2018-20578 HIGH 7.5 UPGRADE An issue was discovered in NuttX before 7.27
FAQ
How do I fix nuttx vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nuttx being exploited right now?
None of the tracked nuttx CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nuttx CVE should I patch first?
CVE-2025-35003 currently ranks highest (71/100): Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulner.