Apache NuttX RTOS Patches Two Filesystem Flaws

The Apache Software Foundation has released updates for Apache NuttX RTOS after revealing two filesystem flaws that could allow attackers to crash systems or corrupt memory, especially when devices expose file services over a network.

The more severe weakness, rated as Moderate, is a Use After Free vulnerability tracked as CVE-2025-48769, located in the fs/vfs/fs_rename code and arising from a recursive implementation and single buffer use by two different pointer variables, which could enable reallocation of a buffer and writes to a freed heap chunk. Affected versions are 7.20 through versions prior to 12.11.0, and exploitation could cause unintended virtual filesystem rename/move results.

The second flaw, tracked as CVE-2025-48768 and rated as Low severity, is a logic error in the fs/inode/fs_inoderemove code that could lead to a Denial of Service by permitting root filesystem inode removal, potentially triggering a NULL pointer dereference or a debug assertion and causing a system crash; this affects versions 10.0.0 through prior to 12.10.0.

Administrators are advised to upgrade to version 12.11.0 for CVE-2025-48769 and to version 12.10.0 for CVE-2025-48768, with the advisory warning that remote access is possible if filesystem services are exposed, for example via FTP.