CVE-2025-35003 Overview
CVE-2025-35003 is a memory corruption vulnerability in the Apache NuttX Real-Time Operating System (RTOS) Bluetooth stack. The flaw affects both the Host Controller Interface (HCI) and Universal Asynchronous Receiver-Transmitter (UART) components. Attackers can send maliciously crafted Bluetooth packets to trigger stack-based buffer overflows and out-of-bounds memory operations. Successful exploitation results in system crash, denial of service, or arbitrary code execution on the affected device. The issue affects Apache NuttX versions from 7.25 before 12.9.0.
Critical Impact
Remote attackers can achieve arbitrary code execution on NuttX-based embedded and Internet of Things (IoT) devices by transmitting crafted Bluetooth packets, with no authentication or user interaction required.
Affected Products
- Apache NuttX RTOS versions 7.25 through 12.8.x
- Apache NuttX Bluetooth HCI component
- Apache NuttX Bluetooth UART transport component
Discovery Timeline
- 2025-05-26 - CVE-2025-35003 published to the National Vulnerability Database (NVD)
- 2025-07-08 - Last updated in NVD database
Technical Details for CVE-2025-35003
Vulnerability Analysis
The vulnerability resides in the NuttX Bluetooth stack implementation, specifically within the HCI and UART transport layers responsible for parsing inbound Bluetooth packets. The code performs improper restriction of operations within the bounds of a memory buffer, classified under [CWE-119]. When the stack receives a malformed packet, length fields and payload boundaries are not validated against the destination buffer size before data is copied.
This condition produces a stack-based buffer overflow that corrupts adjacent stack frames, including saved return addresses. On embedded targets without modern exploit mitigations such as stack canaries or non-executable memory, an attacker can redirect execution flow to attacker-controlled code. NuttX is widely deployed across IoT devices, wearables, and industrial controllers, expanding the practical attack surface.
Root Cause
The root cause is missing length validation in the Bluetooth HCI and UART packet parsing routines. Functions handling incoming HCI events, Asynchronous Connection-Less (ACL) data, and UART-framed Bluetooth payloads copy attacker-controlled bytes into fixed-size stack buffers. The patch in pull request #16179 adds bounds checks and rejects packets that exceed expected sizes.
Attack Vector
The attack vector is network-adjacent through the Bluetooth radio interface. An attacker within Bluetooth range transmits a crafted HCI command or ACL packet with malformed length descriptors. The flaw requires no authentication, no user interaction, and no prior pairing in vulnerable configurations. The vulnerability mechanism is described in the Apache Mailing List Thread and the Openwall OSS-Security Notice. No public proof-of-concept exploit is currently available.
Detection Methods for CVE-2025-35003
Indicators of Compromise
- Unexpected reboots or hard faults on NuttX-based devices following Bluetooth traffic
- Anomalous HCI packets containing oversized length fields received over the UART transport
- Crash dumps showing corrupted return addresses or stack frames in Bluetooth stack functions
- Unscheduled firmware behavior or service interruptions on Bluetooth-enabled embedded systems
Detection Strategies
- Inspect Bluetooth traffic captures for HCI packets where declared length exceeds the protocol-defined maximum
- Enable verbose logging in the NuttX Bluetooth subsystem to record malformed packet rejections
- Monitor device telemetry for kernel panics or watchdog resets correlated with Bluetooth activity
- Audit deployed firmware images to identify NuttX versions earlier than 12.9.0
Monitoring Recommendations
- Track firmware versions across the IoT fleet and flag any device running NuttX between 7.25 and 12.8.x
- Collect and centralize device crash logs for correlation with Bluetooth proximity events
- Deploy Bluetooth radio monitoring in sensitive environments to identify anomalous transmitter activity
How to Mitigate CVE-2025-35003
Immediate Actions Required
- Upgrade Apache NuttX to version 12.9.0 or later on all affected devices
- Inventory all firmware builds that include the NuttX Bluetooth HCI or UART transport components
- Disable Bluetooth functionality on devices where the feature is not required until patching completes
- Restrict physical and radio access to vulnerable devices during the remediation window
Patch Information
The Apache NuttX project addressed the issue in version 12.9.0. The fix is delivered through the GitHub Pull Request #16179, which adds bounds checking to the Bluetooth HCI and UART packet parsing routines. Vendors shipping NuttX-based firmware must rebuild and redistribute updated images to deployed devices.
Workarounds
- Disable the Bluetooth stack in the NuttX configuration if Bluetooth is not required for device operation
- Remove or disable the UART Bluetooth transport driver where the radio interface is unused
- Operate vulnerable devices only inside radio-shielded environments until firmware updates are applied
# Rebuild NuttX from the patched 12.9.0 release
git clone --branch releases/12.9 https://github.com/apache/nuttx.git
cd nuttx
make distclean
./tools/configure.sh <board>:<config>
make
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
