CVE-2025-47868 Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition.
Heap-based buffer overflow in NuttX bdf-converter allows code execution or DoS when processing malicious font data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-47868?
CVE-2025-47868 is a critical memory corruption vulnerability in Apache NuttX RTOS: tools/bdf-converter., published on 16 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part of Apache NuttX RTOS repository. This standalone program is optional and neither part of NuttX RTOS nor Applications runtime, but active bdf-converter users may be affected when this tool is exposed to external provided user data data (i.e. publicly available automation).
This issue affects Apache NuttX: from 6.9 before 12.9.0.
Users are recommended to upgrade to version 12.9.0, which fixes the issue.
Which versions are affected by CVE-2025-47868?
It affects 1 product.
Products include Apache Nuttx.
How do I fix CVE-2025-47868?
No fix has been published for CVE-2025-47868 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-47868 being exploited?
There is no known exploitation of CVE-2025-47868 in the wild and no public exploit code.
Other vulnerabilities in Apache NuttX RTOS: tools/bdf-converter.
- CVE-2025-47869 Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size.
- CVE-2025-35003 Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities.
- CVE-2021-26461 malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds
- CVE-2020-17529 Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP header
- CVE-2020-1939 Null dereference in Apache NuttX (incubating)
Sources
Also known as GHSA-fj9m-mxr3-fvf7.