Skip to main content

FreeRTOS-Kernel CVE-2026-77234

| EUVDEUVD-2026-64012 CRITICAL
Incorrect Authorization (CWE-863)
2026-08-21 AMZN
Authentication Bypass Freertos Kernel
9.3
CVSS 4.0 · Vendor: AMZN
Share

Severity by source

Vendor (AMZN) PRIMARY
9.3 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Local vector and low privilege of an existing unprivileged task (AV:L/PR:L), low complexity, with scope change to kernel context and full C/I/A compromise (S:C, all H).

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

7
Analysis Updated
Aug 21, 2026 - 18:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 21, 2026 - 18:22 vuln.today
cvss_changed
Severity Changed
Aug 21, 2026 - 18:22 NVD
HIGH CRITICAL
CVSS changed
Aug 21, 2026 - 18:22 NVD
8.8 (HIGH) 9.3 (CRITICAL)
Source Code Evidence Fetched
Aug 21, 2026 - 18:18 vuln.today
Analysis Generated
Aug 21, 2026 - 18:18 vuln.today
CVE Published
Aug 21, 2026 - 17:40 cve.org
HIGH 8.8

DescriptionCVE.org

Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context.

To remediate this issue, users should upgrade to version 11.3.1 or later

AnalysisAI

Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task running on Memory Protection Unit (MPU)-enabled ports execute code in the privileged kernel context, collapsing the user/kernel isolation boundary the MPU is meant to enforce. The flaw stems from improper input validation at the kernel's privilege boundary (an authorization failure) and was reported by Amazon (AMZN), the FreeRTOS steward. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Run as unprivileged MPU-restricted task
Delivery
Craft malformed input to kernel service
Exploit
Bypass privilege-boundary authorization check
Execution
Execute code in privileged kernel context
Impact
Full device compromise, MPU isolation defeated
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires (1) a FreeRTOS-Kernel build that enables the MPU port - flat single-privilege builds are not in scope; and (2) the attacker already executing as an unprivileged (MPU-restricted) task on the device, i.e., a pre-existing local foothold (CVSS PR:L, AV:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) with high impact to both the vulnerable and subsequent system (VC/VI/VA:H, SC/SI/SA:H) is internally consistent with the description: exploitation is local, low-complexity, needs no user interaction, and requires only the low privilege of an already-running unprivileged task - but the payoff is total (full kernel-context code execution and loss of MPU isolation), which is why it scores 9.3/Critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can get an unprivileged application task onto an MPU-enabled FreeRTOS device - for example by compromising a lower-trust component or supplying malicious code to a task that loads it - crafts input to a kernel service that the kernel fails to validate at the privilege boundary. The kernel then executes attacker-controlled logic in privileged context, giving full control of the device and defeating MPU isolation. …
Remediation Vendor-released patch: upgrade the FreeRTOS-Kernel to version 11.3.1 or later (https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.1) and rebuild and reflash affected firmware images, since the kernel is statically linked into device firmware rather than patched at runtime. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a complete inventory of all systems running FreeRTOS-Kernel and identify which are running versions 7.0.0 through 11.3.0; document deployment environments for prioritization. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Freertos Kernel

View all
CVE-2026-77236 HIGH
8.3 Aug 21

Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M dev
CVE-2026-77235 HIGH
8.3 Aug 21

Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-p
CVE-2026-77237 HIGH
8.2 Aug 21

Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged ke

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-77234 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy