2 Memory Safety Bugs In FreeRTOS-Plus-TCP Require Immediate Updates For Versions 4.0.0 To 4.4.0

AWS published security bulletin 2026-023-AWS on April 29, 2026, addressing two memory safety vulnerabilities in FreeRTOS-Plus-TCP. The open-source TCP/IP stack, which supports essential networking protocols for FreeRTOS, contains flaws in its IPv6 Router Advertisement option parser that allow insufficient validation of length fields.

The issues, tracked as CVE-2026-7425 and CVE-2026-7426, result in an out-of-bounds read and an out-of-bounds write respectively. These memory operations occur without proper bounds checking, creating a pathway for exploitation by any device on the local network capable of sending crafted Router Advertisement packets.

Vulnerability specifics

According to the AWS advisory, no authentication or user interaction is required to exploit either issue. This means that an attacker does not need credentials or to trick a user into clicking a link. Any device sharing the local network segment with the vulnerable FreeRTOS implementation can potentially trigger the memory safety flaws by injecting malicious packets.

Affected versions

The vulnerabilities impact FreeRTOS-Plus-TCP versions 4.0.0 through 4.2.5 and versions 4.3.0 through 4.4.0. AWS has addressed these issues in FreeRTOS-Plus-TCP version 4.4.1 and version 4.2.6. The vendor recommends upgrading to these latest versions and ensuring that any forked or derivative code is patched to incorporate the new fixes.

Defender's checklist

If upgrading is not immediately possible, AWS suggests deploying devices on isolated network segments where rogue Router Advertisement packets cannot be injected. Espilon collaborated with AWS on this issue through the coordinated vulnerability disclosure process. Organizations should verify their current FreeRTOS-Plus-TCP version against the impacted ranges and plan updates accordingly.

Operational impact

When a low-level networking component like this is compromised, operational continuity depends on how deeply it is integrated into your supply chain. Teams usually need to identify all embedded devices running the affected stack, regardless of whether they connect directly to the internet. Check whether third-party hardware suppliers are using vulnerable versions of FreeRTOS-Plus-TCP in their products. Internal stakeholders, including engineering and procurement, must be informed to coordinate patches or isolations. This ensures that risk exposure is managed across the entire device lifecycle, not just in direct IT assets.

What to do and how to stay safe: FreeRTOS-Plus-TCP

• Audit your inventory of embedded devices to identify those running FreeRTOS-Plus-TCP versions between 4.0.0 and 4.4.0.
• Prioritize upgrading affected devices to version 4.4.1 or 4.2.6 as soon as operationally feasible.
• If immediate updates are not possible, isolate vulnerable devices on separate network segments to prevent local attackers from injecting malicious Router Advertisement packets.
• Monitor vendor communications for any updates regarding forked or derivative code that may require manual patching.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the specific CVE IDs for these FreeRTOS-Plus-TCP vulnerabilities?

The vulnerabilities are identified as CVE-2026-7425 and CVE-2026-7426.

Is authentication required to exploit these flaws?

No, the advisory states that no authentication or user interaction is required to exploit either issue.

Which versions of FreeRTOS-Plus-TCP are patched?

The issues have been addressed in FreeRTOS-Plus-TCP version 4.4.1 and version 4.2.6.