CVE-2026-77236

Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata via an out-of-bounds write with an undersized stack size parameter. To remediate this issue, users should upgrade to version 11.3.1 or later.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/2026-086-aws/	Vendor Advisory
https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.1	Release Notes
https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-vq2f-9qj3-jj2m	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:amazon:freertos:*:*:*:*:*:*:*:*

History

14 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Ausencia de validación de tamaño mínimo en la asignación de contexto seguro en FreeRTOS-Kernel anterior a la versión 11.3.1 podría permitir a usuarios locales corromper los metadatos del heap del entorno seguro mediante una escritura fuera de límites con un parámetro de tamaño de pila insuficiente. Para solucionar este problema, los usuarios deberían actualizar a la versión 11.3.1 o posterior.

Information

Published : 2026-08-21 18:16

Updated : 2026-10-14 19:10

NVD link : CVE-2026-77236

Mitre link : CVE-2026-77236

CVE.ORG link : CVE-2026-77236

JSON object : View

Products Affected

amazon

freertos

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-77236", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77236", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:44:22.521068Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 2.0}], "cvssMetricV40": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "affectedData": [{"vendor": "FreeRTOS", "product": "FreeRTOS-Kernel", "versions": [{"status": "affected", "version": "10.2.0", "versionType": "custom", "lessThanOrEqual": "11.3.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-21T18:16:51.800", "references": [{"url": "https://aws.amazon.com/security/security-bulletins/2026-086-aws/", "tags": ["Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.1", "tags": ["Release Notes"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-vq2f-9qj3-jj2m", "tags": ["Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata via an out-of-bounds write with an undersized stack size parameter.\u00a0To remediate this issue, users should upgrade to version\u00a011.3.1 or later."}, {"lang": "es", "value": "Ausencia de validaci\u00f3n de tama\u00f1o m\u00ednimo en la asignaci\u00f3n de contexto seguro en FreeRTOS-Kernel anterior a la versi\u00f3n 11.3.1 podr\u00eda permitir a usuarios locales corromper los metadatos del heap del entorno seguro mediante una escritura fuera de l\u00edmites con un par\u00e1metro de tama\u00f1o de pila insuficiente. Para solucionar este problema, los usuarios deber\u00edan actualizar a la versi\u00f3n 11.3.1 o posterior."}], "lastModified": "2026-10-14T19:10:00.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:amazon:freertos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5723561-D43A-4A99-AD62-8217B0D7ED17", "versionEndExcluding": "11.3.1", "versionStartIncluding": "10.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}