CVE-2025-48769 is a use-after-free vulnerability in the virtual-filesystem rename code (fs/vfs/fs_rename) of Apache NuttX, a real-time operating system widely used in embedded microcontrollers and IoT firmware: because the recursive directory-move implementation reuses one buffer through two separate pointer variables, a user with filesystem write access, for example over an exposed FTP service, can trigger a buffer reallocation of arbitrary attacker-chosen size and then have data written into the chunk of heap memory that was just freed, corrupting memory and producing unintended rename or move results. NVD has analyzed the report and assigned it a Primary CVSS v3.1 base score of 8.1 (high); the Apache NuttX project itself rated the issue "Moderate" in its own advisory.
Vulnerability summary
8.1
High
0.8%
EPSS score (FIRST)
No
CISA KEV catalog
2026-01-01
Published
Vulnerability ID: CVE-2025-48769 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Apache NuttX RTOS (fs/vfs filesystem rename code) | cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:* | 7.20 before 12.11.0 (fixed in 12.11.0) |
What does this mean for affected devices?
CVE-2025-48769 affects Apache NuttX, an Apache Software Foundation real-time operating system (RTOS) built for resource-constrained embedded systems and used across microcontroller families from vendors such as Espressif (ESP32) and STMicroelectronics (STM32). NVD's description states: "Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single buffer use by two different pointer variables allowed arbitrary user provided size buffer reallocation and write to the previously freed heap chunk, that in specific cases could cause unintended virtual filesystem rename/move operation results" (NVD).
NVD lists the CVE as "Analyzed" with a Primary CVSS v3.1 base score of 8.1 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H; a Secondary CVSS v3.1 score of 5.3 (medium) is also recorded from a third-party CNA (NVD).
The issue affects Apache NuttX RTOS versions "from 7.20 before 12.11.0," and the project's advisory states: "Users of virtual filesystem based services with write access especially when exposed over the network (i.e. FTP) are affected and recommended to upgrade to version 12.11.0 that fixes the issue" (Apache NuttX Security Advisory, oss-security mailing list).
The fix itself, landed as a pull request against the NuttX source tree, describes the change plainly: "Recurrency is removed from filesystem directory rename. Fixes use after free in buffer that was used as output and argument." The patch was tested on real embedded hardware targets before merge — an ESP32-C6 board (esp32c6-xiao:usbnsh) and an STM32 Nucleo H743ZI board driving an FTP session — underscoring that the vulnerable code path runs on production microcontroller firmware, not just host-side tooling (Apache NuttX pull request #16455).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0079 (56.4th percentile) as of 2026-11-06 (CISA KEV, FIRST EPSS).
Device makers and integrators shipping Apache NuttX in firmware, particularly any build that exposes a writable virtual-filesystem service such as FTP over the network, should upgrade to NuttX 12.11.0 or later; builds that only expose read-only filesystem access over the network are not affected by this specific write path.
Evidence
- Use-after-free in fs/vfs/fs_rename: a recursive implementation reuses a single buffer via two different pointer variables, allowing arbitrary-size buffer reallocation and a write into a previously freed heap chunk, with effects on virtual filesystem rename/move operations. — NVD
- NVD status Analyzed; Primary CVSS v3.1 base score 8.1 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H; Secondary CVSS v3.1 score 5.3 (medium). — NVD
- Affects Apache NuttX RTOS from 7.20 before 12.11.0; users of network-exposed writable virtual-filesystem services such as FTP are affected and should upgrade to 12.11.0. — Apache NuttX Security Advisory, oss-security mailing list
- Fix removes recursion from filesystem directory rename to eliminate the use-after-free; tested on an ESP32-C6 board and an STM32 Nucleo H743ZI board with an FTP session. — Apache NuttX pull request #16455
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0079 (56.4th percentile) as of 2026-11-06. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What has to be true for CVE-2025-48769 to be exploitable on a NuttX device?
The device needs a filesystem-based service with write access to the virtual filesystem, and the advisory specifically calls out services exposed over the network such as FTP as the realistic attack path (per Apache NuttX Security Advisory).
What is the root cause of the use-after-free?
The recursive implementation of directory rename in fs/vfs/fs_rename reuses a single buffer through two different pointer variables, so an arbitrary user-provided buffer size can trigger a reallocation and a subsequent write lands in a heap chunk that was already freed (per NVD; per Apache NuttX pull request #16455).
How does the fix work, and was it tested on real hardware?
The fix removes the recursion from the directory-rename code path entirely, eliminating the dual-pointer buffer reuse; the patch was tested on an ESP32-C6 board and an STM32 Nucleo H743ZI board running an FTP session before being merged (per Apache NuttX pull request #16455).
Which NuttX versions are affected, and is this being exploited in the wild?
Versions from 7.20 before 12.11.0 are affected; upgrading to 12.11.0 fixes the issue. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and FIRST's EPSS score of 0.0079 (56.4th percentile) reflects a low near-term exploitation probability (per CISA KEV; per FIRST EPSS).