FreeRTOS-Kernel CVE-2026-77236

Exploitation requires local code execution on the target device with at least low-privilege access (PR:L per the CVSS 4.0 vector), meaning the attacker must already be able to invoke the FreeRTOS secure context allocation API or influence a task that does. The vulnerable code path is only reachable on ARM Cortex-M targets where TrustZone secure context support is compiled in and actively used; embedded systems not using TrustZone secure partitioning are not exposed to this code path. No network access, user interaction, or elevated privileges are required beyond local task execution. Exploitation is further constrained to devices running FreeRTOS-Kernel versions 10.2.0 through 11.3.0.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) establishes that exploitation requires local access with low privileges and no special attack preconditions beyond having code execution on the device. The subsequent-system impact metrics SI:H and SA:H reflect the high-severity consequence of corrupting the TrustZone secure partition's heap - undermining the integrity and availability of the secure world, which is a critical security boundary in embedded designs. The VC:H metric on the vulnerable system likely reflects that heap metadata in the secure world can be read or disclosed through the write primitive. No EPSS data was provided in the input, leaving exploitation probability unquantifiable from probabilistic signals alone. The CVE is not listed in CISA KEV and no POC has been identified, so active exploitation is not confirmed. Despite the absence of public exploitation signals, the severity of crossing a TrustZone security boundary from low-privilege normal-world code is significant for any deployment where the secure partition enforces sensitive operations such as cryptographic key storage or secure boot. The patch (V11.3.1) is available and straightforward to apply, making the residual risk primarily a patch-lag concern.

An attacker with low-privilege code execution on a TrustZone-enabled embedded device running FreeRTOS-Kernel 10.2.0-11.3.0 calls the secure context allocation function with a deliberately undersized stack size parameter. The kernel, lacking minimum-size validation, writes heap bookkeeping data past the end of the intended allocation in the secure-world heap, corrupting adjacent metadata. The attacker can leverage this heap corruption to manipulate secure-world memory management, potentially enabling arbitrary write or code execution within the TrustZone secure partition.