CVE-2026-7424

High

Published: 29/04/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times.

Risk Assessment

An attacker can cause a permanent IP task freeze requiring a hardware reset and disrupt network operations by manipulating DHCPv6 settings.

Recommendation

Users should upgrade to version V4.2.6, V4.4.1, or newer to mitigate the risk associated with this vulnerability.

Other vulnerabilities in FreeRTOS-Plus-TCP

CVE-2026-7426High
In FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1, there is insufficient validation of the prefix length field in IPv6 Router Advertisement processing. This allows an adjacent network actor to cause memory corruption by sending a crafted Router Advertisement with a prefix length value exceeding the maximum valid length, resulting in a heap buffer overflow.

Original NVD description (English source)

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times, and to cause a denial of service (permanent IP task freeze requiring hardware reset) by sending a single crafted DHCPv6 packet. The issue is present whenever DHCPv6 is enabled. To mitigate this issue, users should upgrade to version V4.2.6 or V4.4.1 or newer.