EUVD-2026-64034Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the dual non-default prerequisite (MPU-enabled port AND configUSE_QUEUE_SETS=1); S:C captures the privilege-boundary crossing from unprivileged task into kernel memory.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSE_QUEUE_SETS=1 to read privileged kernel memory. To remediate this issue, users should upgrade to version 11.3.1 or later.
AnalysisAI
Unprivileged task memory disclosure in FreeRTOS-Kernel before 11.3.1 enables a low-privileged task to read privileged kernel memory by exploiting missing type validation in the xQueueAddToSet() function (CWE-843). Exploitation is constrained to deployments using MPU-enabled ports with the queue sets feature active, but on affected configurations the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable system and subsequent (privileged) system contexts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific compile-time configuration conditions must both be present: (1) the target must use an MPU-enabled FreeRTOS port (i.e., the port variant that activates Memory Protection Unit enforcement, segregating unprivileged tasks from kernel memory), and (2) the kernel must be compiled with configUSE_QUEUE_SETS=1 in FreeRTOSConfig.h, enabling the queue set API including xQueueAddToSet(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, score 8.2) indicates local exploitation by a low-privileged task with no user interaction, yielding high confidentiality impact on both the vulnerable system and a subsequent (privileged) system context - here, the kernel memory space. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A firmware image running on an STM32 or similar Cortex-M device with the MPU enabled and configUSE_QUEUE_SETS=1 hosts both a privileged driver task and an unprivileged application task. The unprivileged task calls xQueueAddToSet() passing a handle to an incompatible object type; because the kernel performs no type check, it processes the object as a valid queue-set member and subsequently dereferences or exposes a pointer into privileged memory. … |
| Remediation | Upgrade to FreeRTOS-Kernel version 11.3.1 or later, which introduces the missing type validation in xQueueAddToSet(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running FreeRTOS-Kernel and determine which deployments use both MPU protection and queue sets features (the affected configuration). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Freertos Kernel
View allLocal privilege escalation in FreeRTOS-Kernel versions 7.0.0 through 11.3.0 lets an unprivileged application task runnin
Out-of-bounds heap metadata corruption in FreeRTOS-Kernel's TrustZone secure context allocation exposes ARM Cortex-M dev
Use-after-free in FreeRTOS-Kernel's secure context cleanup handler (versions 10.2.0 through 11.3.0) allows a local low-p
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today