EUVD-2026-26284Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector matches RA link-scope; AC:H reflects AT:P - IPv6 RA must be enabled, a non-default embedded build condition; no scope change as impact stays within the device.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause memory corruption by sending a crafted Router Advertisement with a prefix length value exceeding the maximum valid length, resulting in a heap buffer overflow. Users processing IPv4 RA only are not impacted.
To mitigate this issue, users should upgrade to the fixed version when available.
AnalysisAI
Heap buffer overflow in FreeRTOS-Plus-TCP's IPv6 Router Advertisement parser allows an unauthenticated adjacent network actor to corrupt device memory by sending a crafted RA packet containing an oversized prefix length field exceeding the 128-bit maximum valid for IPv6. Affected versions span two branches: 4.0.0-4.2.5 and 4.3.0-4.4.0, with fixes released as V4.2.6 and V4.4.1 respectively. No public exploit code has been identified, EPSS stands at 0.01% (3rd percentile), and SSVC confirms no active exploitation - making this a patch-priority issue rather than an emergency response.
Technical ContextAI
FreeRTOS-Plus-TCP (CPE: cpe:2.3:a:aws:freertos-plus-tcp) is an embedded TCP/IP networking stack for FreeRTOS, an open-source real-time operating system widely used in resource-constrained IoT, industrial control, and embedded systems. The vulnerable code path handles IPv6 Neighbor Discovery Protocol Router Advertisement (RA) messages, which carry Prefix Information Options encoding a prefix length value (a single octet). RFC 4861 defines valid prefix lengths for IPv6 as 0-128. The implementation fails to validate that the received prefix length does not exceed this maximum before using it to write into a heap-allocated buffer, constituting a CWE-787 (Out-of-bounds Write). Because the stack allocates buffer sizes based on expected maximum prefix length, a crafted value exceeding 128 causes writes past the end of the heap buffer, corrupting adjacent heap metadata or data.
RemediationAI
Upgrade to FreeRTOS-Plus-TCP V4.2.6 (for the 4.0.x/4.1.x/4.2.x branch) or V4.4.1 (for the 4.3.x/4.4.x branch); both releases are available at https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6 and https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1 respectively. For embedded systems where a firmware update cannot be deployed immediately, a targeted compensating control is to disable IPv6 RA processing at build time by removing or disabling the relevant IPv6 RA handler in the FreeRTOS-Plus-TCP configuration - this eliminates the vulnerable code path entirely but removes IPv6 stateless address autoconfiguration (SLAAC) functionality, requiring static IPv6 address assignment as a trade-off. Additionally, restricting the network segment to trusted devices via Layer 2 segmentation or 802.1X reduces the adjacency attack surface. Consult the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-023-aws/ for vendor-specific guidance.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today