CVE-2026-7425
MEDIUMOut-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP
Title source: cnaDescription
Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option that is smaller than the expected structure size. To mitigate this issue, users should upgrade to the fixed version when available.
References (4)
Core 4
Core References
Vendor Advisory vendor-advisory
https://aws.amazon.com/security/security-bulletins/2026-023-aws/
Third Party Advisory third-party-advisory
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-gffr-xgjg-jh9j
Scores
CVSS v3
6.5
EPSS
0.0023
EPSS Percentile
13.9%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-125
Status
published
Products (5)
amazon/freertos-plus-tcp
4.0.0 - 4.2.6
AWS/FreeRTOS-Plus-TCP
4.0.0 - 4.2.6
AWS/FreeRTOS-Plus-TCP
4.2.6
AWS/FreeRTOS-Plus-TCP
4.3.0 - 4.4.1
AWS/FreeRTOS-Plus-TCP
4.4.1
Published
Apr 29, 2026
Tracked Since
Apr 30, 2026