Vulnerability · Published Jun 4, 2025 · Assigned by AMZN

CVE-2025-5688Out of Bounds Write in FreeRTOS-Plus-TCP

High 7.5

In plain English

A high-severity out-of-bounds write in FreeRTOS from Amazon. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

We have identified a buffer overflow issue allowing out-of-bounds write when processing LLMNR or mDNS queries with very long DNS names. This issue only affects systems using Buffer Allocation Scheme 1 with LLMNR or mDNS enabled. Users should upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected products (as reported)

Vendor	Product	Versions
Amazon	FreeRTOS	2.3.4 – before 4.3.2

Weakness: CWE-787 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-012/ vendor-advisory
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.3.2 patch
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-5x4f-fvv8-wr65 vendor-advisory