CVE-2025-47869: Nuttx Xmlrpc Getstring Undersized Destination Buffercve-2025-47869-nuttx-xmlrpc-getstring-undersized-destination-buffer
A local char buffer is passed to xmlrpc_getstring() but is declared with a hardcoded size instead of CONFIG_XMLRPC_STRINGSIZE+1. xmlrpc_getstring() performs an unbounded strcpy() from an internal buffer of CONFIG_XMLRPC_STRINGSIZE+1 bytes, so any smaller destination can be overflowed by a remote attacker-controlled XML-RPC string parameter (CVE-2025-47869).
