FreeRTOS-Kernel EUVD-2026-64013

Exploitation requires local code execution on the target device with at minimum low-privilege process access in the normal world (PR:L per the CVSS 4.0 vector). The vulnerability is only reachable when the FreeRTOS secure context feature is in use on ARM Cortex-M hardware with TrustZone support - deployments without TrustZone-capable hardware or with the secure context feature disabled are not exposed to this code path. There is no requirement for user interaction. Exploitation is bounded by the local access requirement: remote exploitation is not possible without a separate vulnerability first granting local code execution. The attack is further limited to the subset of FreeRTOS deployments that have enabled TrustZone secure contexts, which is a non-default feature requiring explicit hardware and software configuration.

The CVSS 4.0 score of 8.3 reflects a locally-constrained but high-impact vulnerability. AV:L and PR:L cap exposure to authenticated local users, which on embedded devices may represent a lower bar than in general-purpose operating systems where process isolation is stronger. The critical signal is the subsequent-system impact: SI:H and SA:H indicate that successful exploitation compromises the integrity and availability of the TrustZone secure world - a boundary that many embedded security architectures treat as the root of trust. This makes the effective impact significantly worse than a simple crash or memory corruption within a single privilege domain. No KEV listing and no confirmed public exploit code reduce immediate exploitation urgency, and the EPSS score is not provided in the available data. ENISA EUVD tracking and an Amazon security bulletin confirm vendor recognition. The broad affected version range (10.2.0 through 11.3.0) means a large fraction of TrustZone-enabled FreeRTOS deployments are exposed, but deployments without TrustZone hardware or secure context features are not affected. There is no conflict between CVSS signals and the description.

A local low-privileged process on a TrustZone-enabled embedded device running FreeRTOS-Kernel 10.2.0-11.3.0 directly invokes the SVC handler for secure context deallocation without holding the required privilege or owning the target context. Because the cleanup handler does not verify the caller's privilege, it proceeds with deallocation of a secure-world memory region, creating a use-after-free condition that corrupts secure-world data structures. The attacker can leverage this to crash the secure execution environment or potentially escalate from the normal world into the secure world. No public proof-of-concept exploit has been identified at time of analysis.