Vulnerability · Published Apr 29, 2026 · Assigned by AMZN

CVE-2026-7425Out-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP

Medium 6.5

In plain English

A medium-severity out-of-bounds read in FreeRTOS-Plus-TCP from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 85.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option that is smaller than the expected structure size. To mitigate this issue, users should upgrade to the fixed version when available.

Affected products (as reported)

Vendor	Product	Versions
AWS	FreeRTOS-Plus-TCP	4.0.0 – before 4.2.64.3.0 – before 4.4.1

Weakness: CWE-125 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1 patch
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6 patch
https://aws.amazon.com/security/security-bulletins/2026-023-aws/ vendor-advisory
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-gffr-xgjg-jh9j third-party-advisory