Read the docs
TI-2026-06526 Aliases CVE-2026-7423

Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP

Priority LOW 26CWE-191Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-191 and the CVSS impact.

Summary

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB. To mitigate this issue, users should upgrade to the fixed version when available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00221 12th percentileScored 2026-11-07
Fix Fixed FreeRTOS-Plus-TCP (AWS): 4.2.6, 4.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSFreeRTOS-Plus-TCP4.0.0 to before 4.2.6; 4.3.0 to before 4.4.14.2.6, 4.4.1Patch availableCNA
  • FreeRTOS-Plus-TCP VendorAWS Affected 4.0.0 to before 4.2.6; 4.3.0 to before 4.4.1 Fixed in 4.2.6, 4.4.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*4.0.0 to before 4.2.6; 4.3.0 to before 4.4.1VulnerableAWS
  • cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.2.6; 4.3.0 to before 4.4.1 Vulnerable ·AWS

Remediation

  • Fix · CNA FreeRTOS-Plus-TCP (AWS) Fixed in 4.2.6, 4.4.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    AWS FreeRTOS-Plus-TCP — aws.amazon.com/security/security-bulletins/2026-021-aws

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-06525 MAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet ProcessingPriority LOW 30
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7423

References

Patch 3

Advisory 1

  • TI-2024-25630 FreeRTOS-Plus-TCP Buffer Over-Read in DNS Response Parser CVSS 3.1CRITICAL 9.6
  • TI-2026-06527 Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP CVSS 4.0HIGH 7.2
  • TI-2026-06525 MAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing CVSS 4.0HIGH 7.1
  • TI-2026-06529 Out-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP CVSS 4.0MEDIUM 6.1
  • TI-2026-06528 Out-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP CVSS 4.0MEDIUM 6.0
  • TI-2025-10648 Invalid Pointer Dereference when receiving UDP/IPv6 packets in FreeRTOS-Plus-TCP CVSS 4.0MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences