EUVD-2026-26283Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector and no-privilege crash with high availability impact; AC:H reflects the AT:P precondition that IPv6 must be enabled, a specific deployment condition outside attacker control.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option that is smaller than the expected structure size.
To mitigate this issue, users should upgrade to the fixed version when available.
AnalysisAI
Denial of service via crafted ICMPv6 Router Advertisement in FreeRTOS-Plus-TCP affects embedded devices running versions 4.0.0-4.2.5 and 4.3.0-4.4.0, crashing the device when a truncated PREFIX_INFORMATION option triggers an out-of-bounds read in the IPv6 RA parser. An adjacent-network attacker with no privileges or user interaction can repeatedly crash affected IoT/embedded devices, causing persistent availability loss. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.01% (3rd percentile), but vendor-confirmed patches exist for both affected branches.
Technical ContextAI
FreeRTOS-Plus-TCP is an open-source TCP/IP networking library for FreeRTOS-based embedded and IoT systems, maintained and distributed by AWS (CPE: cpe:2.3:a:aws:freertos-plus-tcp). The vulnerable component is the IPv6 Router Advertisement (RA) parser, which processes ICMPv6 RA messages used for stateless address autoconfiguration (SLAAC). The root cause is CWE-125 (Out-of-Bounds Read): the parser performs a structure-sized cast on the PREFIX_INFORMATION option without first validating that the received option length meets the minimum expected structure size. When a crafted RA arrives with a truncated option, the parser reads beyond the buffer boundary into adjacent memory, triggering a device crash. This class of vulnerability is characteristic of embedded network stacks that apply fixed-size struct overlays to variable-length network protocol fields without length guards, a pattern made riskier in resource-constrained environments where bounds checking is often omitted for performance.
RemediationAI
Upgrade FreeRTOS-Plus-TCP to V4.2.6 (for projects on the 4.0.x-4.2.x branch) or V4.4.1 (for projects on the 4.3.x-4.4.x branch); both releases are confirmed available at https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6 and https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1 respectively, and the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-023-aws/ provides additional vendor guidance. Where immediate patching is not feasible due to firmware build cycles, two targeted compensating controls are available: (1) Disable IPv6 entirely on affected devices, which eliminates the attack surface completely but sacrifices IPv6 connectivity - acceptable for IPv4-only deployments; (2) Deploy RA Guard on adjacent switches/routers to filter crafted Router Advertisement packets at the network layer, which preserves IPv6 operation but requires managed network infrastructure and will not protect against threats already on the local segment.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today