Read the docs
TI-2025-30292 Aliases CVE-2025-47868GHSA-fj9m-mxr3-fvf7

Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition.

Priority MEDIUM 50CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part of Apache NuttX RTOS repository. This standalone program is optional and neither part of NuttX RTOS nor Applications runtime, but active bdf-converter users may be affected when this tool is exposed to external provided user data data (i.e. publicly available automation). This issue affects Apache NuttX: from 6.9 before 12.9.0. Users are recommended to upgrade to version 12.9.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00741 54th percentileScored 2026-11-07
Fix Fixed Apache NuttX RTOS: tools/bdf-converter. (Apache Software Foundation): 12.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache NuttX RTOS: tools/bdf-converter.6.9 to before 12.9.012.9.0Patch availableCNA
  • Apache NuttX RTOS: tools/bdf-converter. VendorApache Affected 6.9 to before 12.9.0 Fixed in 12.9.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:*6.9 to before 12.9.0VulnerableApache
  • cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:* Versions 6.9 to before 12.9.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache NuttX RTOS: tools/bdf-converter. (Apache Software Foundation) Fixed in 12.9.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-47868
  2. 2026-10-03 Alias added: GHSA-fj9m-mxr3-fvf7

References

Patch 1

Advisory 2

  • TI-2025-24548 Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities. CVSS 3.1CRITICAL 9.8
  • TI-2025-30293 Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size. CVSS 3.1CRITICAL 9.8
  • TI-2021-08260 malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds CVSS 3.1CRITICAL 9.8
  • TI-2020-13277 Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP header CVSS 3.1CRITICAL 9.8
  • TI-2020-01863 NULL pointer dereference in Apache NuttX CVSS 3.1CRITICAL 9.8
  • TI-2020-13276 Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent length CVSS 3.1CRITICAL 9.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences