CVE-2025-48990 NeKernel has Heap Overflow in `rt_copy_memory`
A 1-byte heap overflow in NeKernel's rt_copy_memory function allows attackers to potentially execute code or crash the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-48990?
CVE-2025-48990 is a high-severity memory corruption vulnerability in nekernel-org nekernel, published on 2 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
NeKernal is a free and open-source operating system stack. Version 0.0.2 has a 1-byte heap overflow in `rt_copy_memory`, which unconditionally wrote a null terminator at `dst[len]`. When `len` equals the size of the destination buffer (256 bytes), that extra `'\0'` write overruns the buffer by one byte. To avoid breaking existing callers or changing the public API, the patch in commit fb7b7f658327f659c6a6da1af151cb389c2ca4ee takes a minimal approach: it simply removes the overflow-causing line without adding bounds checks or altering the function signature.
Weakness: CWE-122
Which versions are affected by CVE-2025-48990?
How do I fix CVE-2025-48990?
No fix has been published for CVE-2025-48990 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-48990 being exploited?
There is no known exploitation of CVE-2025-48990 in the wild and no public exploit code.
Sources
Also known as GHSA-jvvh-fp57-2p32.