CVE-2025-11617
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving an IPv6 packet with incorrect payload lengths in the packet header. This issue only affects applications using IPv6.
Risk Assessment
An attacker could send a crafted IPv6 packet to trigger an out-of-bounds read, potentially causing device crash or data leakage. In embedded systems, this could lead to remote code execution.
Recommendation
Update FreeRTOS-Plus-TCP to the latest version and ensure any forks or derivative code are patched.
Other vulnerabilities in FreeRTOS-Plus-TCP
See all- CVE-2026-7426High
In FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1, there is insufficient validation of the prefix length field in IPv6 Router Advertisement processing. This allows an adjacent network actor to cause memory corruption by sending a crafted Router Advertisement with a prefix length value exceeding the maximum valid length, resulting in a heap buffer overflow.
- CVE-2026-7424High
An integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times.
- CVE-2025-11618Medium
A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field. This issue only affects applications using IPv6.
- CVE-2025-11616Medium
A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. These issues only affect applications using IPv6.
Original NVD description (English source)
A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving a IPv6 packet with incorrect payload lengths in the packet header. This issue only affects applications using IPv6. We recommend users upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS