Skip to main content

FreeRTOS-Kernel CVE-2026-77236

| EUVDEUVD-2026-64017 HIGH
Out-of-bounds Write (CWE-787)
2026-08-21 AMZN
Memory Corruption Buffer Overflow Freertos Kernel
8.3
CVSS 4.0 · Vendor: AMZN
Share

Severity by source

Vendor (AMZN) PRIMARY
8.3 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Local access with low privileges maps directly from description; scope change reflects cross-domain heap corruption impacting the TrustZone secure partition as a distinct security context.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:H/SA:H

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

6
Analysis Updated
Aug 21, 2026 - 18:30 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 21, 2026 - 18:22 vuln.today
cvss_changed
CVSS changed
Aug 21, 2026 - 18:22 NVD
7.3 (HIGH) 8.3 (HIGH)
Source Code Evidence Fetched
Aug 21, 2026 - 18:20 vuln.today
Analysis Generated
Aug 21, 2026 - 18:20 vuln.today
CVE Published
Aug 21, 2026 - 17:47 cve.org
HIGH 7.3

DescriptionCVE.org

Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata via an out-of-bounds write with an undersized stack size parameter. To remediate this issue, users should upgrade to version 11.3.1 or later.

AnalysisAI

Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M devices to local privilege escalation across the normal-to-secure world boundary. Versions 10.2.0 through 11.3.0 are affected; an attacker with low-privilege local code execution can supply an undersized stack size parameter that bypasses missing minimum-size validation, triggering a CWE-787 out-of-bounds write into secure-world heap metadata. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain low-privilege local code execution
Delivery
Identify secure context allocation API call site
Exploit
Pass undersized stack size parameter
Execution
Trigger out-of-bounds write in secure-world heap
Persist
Corrupt heap metadata in TrustZone secure partition
Impact
Undermine secure-world integrity or availability
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires local code execution on the target device with at least low-privilege access (PR:L per the CVSS 4.0 vector), meaning the attacker must already be able to invoke the FreeRTOS secure context allocation API or influence a task that does. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) establishes that exploitation requires local access with low privileges and no special attack preconditions beyond having code execution on the device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with low-privilege code execution on a TrustZone-enabled embedded device running FreeRTOS-Kernel 10.2.0-11.3.0 calls the secure context allocation function with a deliberately undersized stack size parameter. The kernel, lacking minimum-size validation, writes heap bookkeeping data past the end of the intended allocation in the secure-world heap, corrupting adjacent metadata. …
Remediation The primary remediation is upgrading FreeRTOS-Kernel to version 11.3.1 or later, available at https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.1 and documented in the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-086-aws/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all firmware repositories and deployed systems to identify current FreeRTOS-Kernel versions and confirm which deployments fall within the 10.2.0-11.3.0 vulnerable range. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Freertos Kernel

View all
CVE-2026-77234 CRITICAL
9.3 Aug 21

Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task runnin
CVE-2026-77235 HIGH
8.3 Aug 21

Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-p
CVE-2026-77237 HIGH
8.2 Aug 21

Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged ke

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2026-77236 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy