Skip to main content

FreeRTOS-Kernel CVE-2026-77237

| EUVDEUVD-2026-64034 HIGH
Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)
2026-08-21 AMZN
Memory Corruption Information Disclosure Freertos Kernel
8.2
CVSS 4.0 · Vendor: AMZN
Share

Severity by source

Vendor (AMZN) PRIMARY
8.2 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.6 MEDIUM

AC:H reflects the dual non-default prerequisite (MPU-enabled port AND configUSE_QUEUE_SETS=1); S:C captures the privilege-boundary crossing from unprivileged task into kernel memory.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Aug 21, 2026 - 18:32 vuln.today
Severity Changed
Aug 21, 2026 - 18:22 NVD
MEDIUM HIGH
CVSS changed
Aug 21, 2026 - 18:22 NVD
6.5 (MEDIUM) 8.2 (HIGH)
CVE Published
Aug 21, 2026 - 17:52 cve.org
HIGH 8.2

DescriptionCVE.org

Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSE_QUEUE_SETS=1 to read privileged kernel memory. To remediate this issue, users should upgrade to version 11.3.1 or later.

AnalysisAI

Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged kernel memory by exploiting missing type validation in the xQueueAddToSet() function (CWE-843). Exploitation is constrained to deployments using MPU-enabled ports with the queue sets feature active, but on affected configurations the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable system and subsequent (privileged) system contexts. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain unprivileged task execution on device
Delivery
Identify MPU-enabled port with queue sets active
Exploit
Call xQueueAddToSet() with incompatible handle type
Execution
Kernel skips type validation, misinterprets memory
Persist
Read privileged kernel memory across MPU boundary
Impact
Extract sensitive runtime data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two specific compile-time configuration conditions must both be present: (1) the target must use an MPU-enabled FreeRTOS port (i.e., the port variant that activates Memory Protection Unit enforcement, segregating unprivileged tasks from kernel memory), and (2) the kernel must be compiled with configUSE_QUEUE_SETS=1 in FreeRTOSConfig.h, enabling the queue set API including xQueueAddToSet(). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, score 8.2) indicates local exploitation by a low-privileged task with no user interaction, yielding high confidentiality impact on both the vulnerable system and a subsequent (privileged) system context - here, the kernel memory space. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A firmware image running on an STM32 or similar Cortex-M device with the MPU enabled and configUSE_QUEUE_SETS=1 hosts both a privileged driver task and an unprivileged application task. The unprivileged task calls xQueueAddToSet() passing a handle to an incompatible object type; because the kernel performs no type check, it processes the object as a valid queue-set member and subsequently dereferences or exposes a pointer into privileged memory. …
Remediation Upgrade to FreeRTOS-Kernel version 11.3.1 or later, which introduces the missing type validation in xQueueAddToSet(). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running FreeRTOS-Kernel and determine which deployments use both MPU protection and queue sets features (the affected configuration). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Freertos Kernel

View all
CVE-2026-77234 CRITICAL
9.3 Aug 21

Local privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task runnin
CVE-2026-77236 HIGH
8.3 Aug 21

Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M dev
CVE-2026-77235 HIGH
8.3 Aug 21

Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-p

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

View all
CVE-2011-0611 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2017-8291 HIGH POC
7.8
CVE-2016-7201 HIGH POC
8.8
CVE-2017-0037 HIGH POC
8.1
CVE-2019-0752 HIGH POC
7.5
CVE-2017-5070 HIGH POC
8.8
CVE-2025-30397 HIGH POC
7.5

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2026-77237 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy