CVE-2026-7423

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB. To mitigate this issue, users should upgrade to the fixed version when available.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/2026-021-aws/	Vendor Advisory
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6	Release Notes
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1	Release Notes
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-7r59-2pgv-9v2r	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:amazon:freertos-plus-tcp::::::::
	cpe:2.3:a:amazon:freertos-plus-tcp::::::::

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Desbordamiento negativo de enteros en los manejadores de respuesta de eco ICMP e ICMPv6 en FreeRTOS-Plus-TCP anterior a V4.4.1 y V4.2.6 permite a un usuario de red adyacente causar una denegación de servicio (caída del dispositivo) cuando el soporte de ping saliente está habilitado, porque los tamaños de las cabeceras se restan de un campo de longitud de paquete sin validar que el campo sea lo suficientemente grande, lo que resulta en una lectura fuera de límites de la pila (heap) de hasta aproximadamente 65KB. Para mitigar este problema, los usuarios deberían actualizar a la versión corregida cuando esté disponible.

Information

Published : 2026-04-29 19:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-7423

Mitre link : CVE-2026-7423

CVE.ORG link : CVE-2026-7423

JSON object : View

Products Affected

amazon

freertos-plus-tcp

CWE

CWE-191

Integer Underflow (Wrap or Wraparound)

{"id": "CVE-2026-7423", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7423", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-29T19:08:03.742434Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "affectedData": [{"vendor": "AWS", "product": "FreeRTOS-Plus-TCP", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.2.6", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.4.1", "versionType": "semver"}, {"status": "unaffected", "version": "4.2.6"}, {"status": "unaffected", "version": "4.4.1"}], "collectionURL": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP", "defaultStatus": "unaffected"}]}], "published": "2026-04-29T19:16:26.617", "references": [{"url": "https://aws.amazon.com/security/security-bulletins/2026-021-aws/", "tags": ["Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6", "tags": ["Release Notes"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1", "tags": ["Release Notes"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-7r59-2pgv-9v2r", "tags": ["Patch", "Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "description": [{"lang": "en", "value": "CWE-191"}]}], "descriptions": [{"lang": "en", "value": "Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB.\n\n\n\nTo mitigate this issue, users should upgrade to the fixed version when available."}, {"lang": "es", "value": "Desbordamiento negativo de enteros en los manejadores de respuesta de eco ICMP e ICMPv6 en FreeRTOS-Plus-TCP anterior a V4.4.1 y V4.2.6 permite a un usuario de red adyacente causar una denegaci\u00f3n de servicio (ca\u00edda del dispositivo) cuando el soporte de ping saliente est\u00e1 habilitado, porque los tama\u00f1os de las cabeceras se restan de un campo de longitud de paquete sin validar que el campo sea lo suficientemente grande, lo que resulta en una lectura fuera de l\u00edmites de la pila (heap) de hasta aproximadamente 65KB.\n\nPara mitigar este problema, los usuarios deber\u00edan actualizar a la versi\u00f3n corregida cuando est\u00e9 disponible."}], "lastModified": "2026-10-26T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE7A5C38-9CEA-461B-9272-3B8BFC06BFEE", "versionEndExcluding": "4.2.6", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "375C7032-9CFB-480C-BFFA-029C985A82B7", "versionEndExcluding": "4.4.1", "versionStartIncluding": "4.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}