CVE-2026-7424

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times, and to cause a denial of service (permanent IP task freeze requiring hardware reset) by sending a single crafted DHCPv6 packet. The issue is present whenever DHCPv6 is enabled. To mitigate this issue, users should upgrade to version V4.2.6 or V4.4.1 or newer.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/2026-022-aws/	Vendor Advisory
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6	Release Notes
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1	Release Notes
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-wrhm-c99p-2p8g	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:amazon:freertos-plus-tcp::::::::
	cpe:2.3:a:amazon:freertos-plus-tcp::::::::

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Un desbordamiento negativo de enteros en el analizador de subopciones DHCPv6 en FreeRTOS-Plus-TCP anterior a las versiones V4.4.1 y V4.2.6 permite a un actor de red adyacente corromper la asignación de direcciones IPv6 del dispositivo, la configuración DNS y los tiempos de concesión, y causar una denegación de servicio (congelación permanente de la tarea IP que requiere un reinicio de hardware) mediante el envío de un único paquete DHCPv6 manipulado. El problema está presente siempre que DHCPv6 esté habilitado. Para mitigar este problema, los usuarios deben actualizar a la versión V4.2.6 o V4.4.1 o posterior.

Information

Published : 2026-04-29 19:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-7424

Mitre link : CVE-2026-7424

CVE.ORG link : CVE-2026-7424

JSON object : View

Products Affected

amazon

freertos-plus-tcp

CWE

CWE-191

Integer Underflow (Wrap or Wraparound)

{"id": "CVE-2026-7424", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7424", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-29T19:08:53.836749Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "affectedData": [{"vendor": "AWS", "product": "FreeRTOS-Plus-TCP", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.2.6", "versionType": "semver"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.4.1", "versionType": "semver"}, {"status": "unaffected", "version": "4.2.6"}, {"status": "unaffected", "version": "4.4.1"}], "collectionURL": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP", "defaultStatus": "unaffected"}]}], "published": "2026-04-29T19:16:26.743", "references": [{"url": "https://aws.amazon.com/security/security-bulletins/2026-022-aws/", "tags": ["Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6", "tags": ["Release Notes"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1", "tags": ["Release Notes"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-wrhm-c99p-2p8g", "tags": ["Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "description": [{"lang": "en", "value": "CWE-191"}]}], "descriptions": [{"lang": "en", "value": "Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times, and to cause a denial of service (permanent IP task freeze requiring hardware reset) by sending a single crafted DHCPv6 packet.\n\n\n\n\n\n\n\n\nThe issue is present whenever DHCPv6 is enabled.\n\n\n\n\n\n\n\n\nTo mitigate this issue, users should upgrade to version V4.2.6 or V4.4.1 or newer."}, {"lang": "es", "value": "Un desbordamiento negativo de enteros en el analizador de subopciones DHCPv6 en FreeRTOS-Plus-TCP anterior a las versiones V4.4.1 y V4.2.6 permite a un actor de red adyacente corromper la asignaci\u00f3n de direcciones IPv6 del dispositivo, la configuraci\u00f3n DNS y los tiempos de concesi\u00f3n, y causar una denegaci\u00f3n de servicio (congelaci\u00f3n permanente de la tarea IP que requiere un reinicio de hardware) mediante el env\u00edo de un \u00fanico paquete DHCPv6 manipulado.\n\nEl problema est\u00e1 presente siempre que DHCPv6 est\u00e9 habilitado.\n\nPara mitigar este problema, los usuarios deben actualizar a la versi\u00f3n V4.2.6 o V4.4.1 o posterior."}], "lastModified": "2026-10-26T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE7A5C38-9CEA-461B-9272-3B8BFC06BFEE", "versionEndExcluding": "4.2.6", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "375C7032-9CFB-480C-BFFA-029C985A82B7", "versionEndExcluding": "4.4.1", "versionStartIncluding": "4.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}