CVE-2026-7423
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6. When outgoing ping support is enabled, header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB.
Risk Assessment
An adjacent network user can cause a device crash (denial of service), potentially disrupting embedded systems based on FreeRTOS. The heap out-of-bounds read may also potentially leak memory data.
Recommendation
Upgrade FreeRTOS-Plus-TCP to V4.4.1 or V4.2.6 (or later) when available. Until patched, consider disabling outgoing ping support if not required.
Other vulnerabilities in FreeRTOS-Plus-TCP
See all- CVE-2026-7426High
In FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1, there is insufficient validation of the prefix length field in IPv6 Router Advertisement processing. This allows an adjacent network actor to cause memory corruption by sending a crafted Router Advertisement with a prefix length value exceeding the maximum valid length, resulting in a heap buffer overflow.
- CVE-2026-7425Medium
Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option smaller than the expected structure size.
- CVE-2026-7424High
An integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times.
- CVE-2026-7422Medium
Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism skips all input validation for packets whose source MAC matches a local endpoint. To mitigate this issue, users should upgrade to the fixed version when available.
- CVE-2025-11618Medium
A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field. This issue only affects applications using IPv6.
- CVE-2025-11617Medium
A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving an IPv6 packet with incorrect payload lengths in the packet header. This issue only affects applications using IPv6.
- CVE-2025-11616Medium
A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. These issues only affect applications using IPv6.
Original NVD description (English source)
Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB. To mitigate this issue, users should upgrade to the fixed version when available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS