TI-2021-08260 Aliases CVE-2021-26461 GHSA-h737-8f7x-38jh

malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds

MEDIUM 50CWE-190Published 2021-06-21 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.

Why it matters now

EPSS 0.05038 92nd percentileScored 2026-11-07

Fix Fixed Apache NuttX (Apache Software Foundation): 10.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache NuttX	Apache NuttX to before 10.1.0	10.1.0	Patch available	CNA

Apache NuttX VendorApache Affected Apache NuttX to before 10.1.0 Fixed in 10.1.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:nuttx::::::::	before 10.1.0	Vulnerable	Apache

cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:* Versions before 10.1.0 Vulnerable ·Apache

Remediation

Fix · CNA Apache NuttX (Apache Software Foundation) Fixed in 10.1.0

Timeline

2026-10-02 Threatist record created from CVE-2021-26461
2026-10-03 Alias added: GHSA-h737-8f7x-38jh

References

Advisory 1

https://lists.apache.org/thread.html/r806fccf8b003ae812d807c6c7d97950d44ed29b2713418cbe3f2bddd%40%3Cdev.nuttx.apache.org%3E

TI-2025-24548 Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities. CVSS 3.1CRITICAL 9.8
TI-2025-30293 Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size. CVSS 3.1CRITICAL 9.8
TI-2025-30292 Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition. CVSS 3.1CRITICAL 9.8
TI-2020-13277 Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP header CVSS 3.1CRITICAL 9.8
TI-2020-01863 NULL pointer dereference in Apache NuttX CVSS 3.1CRITICAL 9.8
TI-2020-13276 Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent length CVSS 3.1CRITICAL 9.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences