Which versions of FreeRTOS-Plus-TCP are affected by CVE-2026-7424?

Amazon FreeRTOS-Plus-TCP embedded systems can be disabled remotely via network attacks, requiring manual physical reboots to restore functionality.. A patch is available.

How to fix or mitigate CVE-2026-7424?

Within 24 hours, inventory all deployed FreeRTOS-Plus-TCP instances and determine which devices run affected versions (4.0.0-4.2.5 or 4.3.0-4.4.0), communicating findings to device operations teams. Within 7 days, obtain the vendor-released patch from Amazon and validate it in a representative staging environment for functional compatibility and integration. Within 30 days, deploy the patch across all production devices, prioritizing those on networks where adjacent-network attackers could be present or where infrastructure criticality is highest.

FreeRTOS-Plus-TCP CVE-2026-7424

Q: What is the CVSS score of CVE-2026-7424?

CVE-2026-7424 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26277 HIGH

Integer Underflow (CWE-191)

2026-04-29 AMZN

Denial Of Service Integer Overflow Freertos Plus Tcp Amazon

7.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Adjacent unauthenticated single-packet trigger (AV:A/AC:L/PR:N/UI:N); config corruption gives I:H and permanent IP-task freeze gives A:H, with no data disclosure so C:N.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 01:29 vuln.today

Analysis Generated

Jul 24, 2026 - 01:29 vuln.today

CVSS changed

Apr 29, 2026 - 19:22 NVD

8.1 (HIGH) 7.2 (HIGH)

EUVD ID Assigned

Apr 29, 2026 - 19:00 euvd

EUVD-2026-26277

Patch released

Apr 29, 2026 - 19:00 nvd

Patch available

CVE Published

Apr 29, 2026 - 18:51 nvd

HIGH 7.2

DescriptionCVE.org

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times, and to cause a denial of service (permanent IP task freeze requiring hardware reset) by sending a single crafted DHCPv6 packet.

The issue is present whenever DHCPv6 is enabled.

To mitigate this issue, users should upgrade to version V4.2.6 or V4.4.1 or newer.

AnalysisAI

Denial of service and network-configuration corruption in Amazon's FreeRTOS-Plus-TCP embedded IP stack (versions 4.0.0-4.2.5 and 4.3.0-4.4.0) allows an adjacent-network attacker to send a single crafted DHCPv6 packet that triggers an integer underflow in the DHCPv6 sub-option parser, corrupting the device's IPv6 address, DNS settings, and lease times and permanently freezing the IP task until a hardware reset. Exploitation requires no authentication and no user interaction on any device with DHCPv6 enabled. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and CISA SSVC rates exploitation as none, though the technical impact is assessed as total.

Technical ContextAI

FreeRTOS-Plus-TCP is the TCP/IP stack add-on for the FreeRTOS real-time operating system, widely used on resource-constrained microcontrollers and IoT/embedded devices (CPE cpe:2.3:a:amazon:freertos-plus-tcp). The flaw is a CWE-191 integer underflow in the code that parses DHCPv6 sub-options - length or offset arithmetic wraps below zero, producing a huge unsigned value that drives out-of-bounds reads/processing during option handling. Because DHCPv6 messages configure IPv6 addressing, DNS, and lease timers, corrupt parsing propagates into the device's network configuration, and the malformed state deadlocks the single IP task that FreeRTOS-Plus-TCP uses to service the stack, leaving the device unreachable until it is power-cycled.

RemediationAI

Vendor-released patch: upgrade to FreeRTOS-Plus-TCP V4.2.6 (for the 4.0.x-4.2.x line) or V4.4.1 (for the 4.3.x line) or newer, then rebuild and reflash affected device firmware; release artifacts are at https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6 and https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1, with guidance in the AWS bulletin (https://aws.amazon.com/security/security-bulletins/2026-022-aws/) and GHSA-wrhm-c99p-2p8g. Where firmware cannot be updated immediately, the most effective compensating control is to disable DHCPv6 in the FreeRTOS-Plus-TCP configuration and use static IPv6 (or IPv4-only) addressing, since the flaw is only reachable when DHCPv6 is enabled - the trade-off is loss of dynamic IPv6 provisioning. Additional network-layer mitigations: place devices on a trusted, isolated VLAN/segment and block or filter DHCPv6 traffic (UDP 546/547 and ff02::1:2 multicast) from untrusted hosts using DHCPv6 guard / RA-guard on managed switches, accepting that this only works where segmentation is enforceable and may interfere with legitimate DHCPv6 servers.