Read the docs
TI-2021-08989 Aliases CVE-2021-27504GHSA-6627-82c3-q8c9

Texas Instruments FREERTOS Integer Overflow or Wraparound

Priority LOW 34CWE-190Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

Texas Instruments devices running FREERTOS, malloc returns a valid pointer to a small buffer on extremely large values, which can trigger an integer overflow vulnerability in 'malloc' for FreeRTOS, resulting in code execution.

Why it matters now

EPSS 0.00279 20th percentileScored 2026-11-07
Fix Fixed CC32XX (Texas Instruments): 4.40.00.07SimpleLink-CC13XX (Texas Instruments): 4.40.00+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Texas InstrumentsCC32XXbefore 4.40.00.074.40.00.07Patch availableCNA
Texas InstrumentsSimpleLink MSP432E4XXall versions—No fix listedCNA
Texas InstrumentsSimpleLink-CC13XXbefore 4.40.004.40.00Patch availableCNA
Texas InstrumentsSimpleLink-CC26XXbefore 4.40.004.40.00Patch availableCNA
Texas InstrumentsSimpleLink-CC32XXbefore 4.10.034.10.03Patch availableCNA
  • CC32XX VendorTexas Instruments Affected before 4.40.00.07 Fixed in 4.40.00.07 Patch available CNA
  • SimpleLink MSP432E4XX VendorTexas Instruments Affected all versions Fixed in — No fix listed CNA
  • SimpleLink-CC13XX VendorTexas Instruments Affected before 4.40.00 Fixed in 4.40.00 Patch available CNA
  • SimpleLink-CC26XX VendorTexas Instruments Affected before 4.40.00 Fixed in 4.40.00 Patch available CNA
  • SimpleLink-CC32XX VendorTexas Instruments Affected before 4.10.03 Fixed in 4.10.03 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:amazon:freertos:10.4.1:*:*:*:*:*:*:*10.4.1VulnerableAWS
cpe:2.3:a:ti:simplelink_cc13xx_software_development_kit:*:*:*:*:*:*:*:*before 4.40.00VulnerableTexas Instruments
cpe:2.3:a:ti:simplelink_cc26xx_software_development_kit:*:*:*:*:*:*:*:*before 4.40.00VulnerableTexas Instruments
cpe:2.3:a:ti:simplelink_cc32xx_software_development_kit:*:*:*:*:*:*:*:*before 4.10.03VulnerableTexas Instruments
cpe:2.3:a:ti:simplelink_msp432e401y:-:*:*:*:*:*:*:*not specified by NVDVulnerableTexas Instruments
cpe:2.3:a:ti:simplelink_msp432e411y:-:*:*:*:*:*:*:*not specified by NVDVulnerableTexas Instruments
  • cpe:2.3:o:amazon:freertos:10.4.1:*:*:*:*:*:*:* Versions 10.4.1 Vulnerable ·AWS
  • cpe:2.3:a:ti:simplelink_cc13xx_software_development_kit:*:*:*:*:*:*:*:* Versions before 4.40.00 Vulnerable ·Texas Instruments
  • cpe:2.3:a:ti:simplelink_cc26xx_software_development_kit:*:*:*:*:*:*:*:* Versions before 4.40.00 Vulnerable ·Texas Instruments
  • cpe:2.3:a:ti:simplelink_cc32xx_software_development_kit:*:*:*:*:*:*:*:* Versions before 4.10.03 Vulnerable ·Texas Instruments
  • cpe:2.3:a:ti:simplelink_msp432e401y:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Texas Instruments
  • cpe:2.3:a:ti:simplelink_msp432e411y:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Texas Instruments

Remediation

  • Fix · CNA CC32XX (Texas Instruments) Fixed in 4.40.00.07
  • Fix · CNA SimpleLink-CC13XX (Texas Instruments) Fixed in 4.40.00
  • Fix · CNA SimpleLink-CC26XX (Texas Instruments) Fixed in 4.40.00
  • Fix · CNA SimpleLink-CC32XX (Texas Instruments) Fixed in 4.10.03

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Texas Instruments CC32XX, SimpleLink-CC13XX and 2 more products 4.10.03, 4.40.00, 4.40.00.07

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-08987 Texas Instruments TI-RTOS Integer Overflow or WraparoundPriority LOW 34
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-27504
  2. 2026-10-03 Alias added: GHSA-6627-82c3-q8c9

References

Advisory 1

Other 1

  • TI-2021-08987 Texas Instruments TI-RTOS Integer Overflow or Wraparound CVSS 3.1HIGH 7.8
  • TI-2021-08918 Texas Instruments TI-RTOS Integer Overflow or Wraparound CVSS 3.1HIGH 7.8
  • TI-2021-05529 Texas Instruments TI-RTOS Integer Overflow or Wraparound CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences