AWS Fixes Two Memory Safety Flaws in FreeRTOS-Plus-TCP IPv6 Parser

Amazon Web Services published security bulletin 2026-023-AWS on April 29, 2026, disclosing two memory safety vulnerabilities in its open-source FreeRTOS-Plus-TCP stack. The advisory identifies CVE-2026-7425 and CVE-2026-7426 as issues that involve out-of-bounds read and write flaws in the software’s networking components.

The vulnerabilities reside in the IPv6 Router Advertisement option parser within the FreeRTOS-Plus-TCP implementation. According to the AWS advisory, insufficient validation of length fields allows for out-of-bounds read operations in one case and out-of-bounds write operations in the other. These flaws enable memory operations without proper bounds checking.

Technical Context and Exploitation

Both CVE-2026-7425 and CVE-2026-7426 can be exploited by any device present on the same local network segment as the vulnerable target. An attacker does not need authentication credentials or user interaction to launch an exploit. By sending crafted Router Advertisement packets, a malicious actor can trigger the out-of-bounds memory access issues described in the bulletin.

FreeRTOS-Plus-TCP is an open-source TCP/IP stack designed for the FreeRTOS operating system. It provides a standard Berkeley sockets interface and supports essential networking protocols, including IPv6, ARP, DHCP, DNS, and Router Advertisement. The stack is designed for use with FreeRTOS.

Affected Versions and Fixes

The vulnerabilities impact FreeRTOS-Plus-TCP versions greater than or equal to 4.0.0 and less than or equal to 4.2.5. Additionally, versions greater than or equal to 4.3.0 and less than or equal to 4.4.0 are also affected. AWS has addressed these issues in FreeRTOS-Plus-TCP version 4.4.1 and version 4.2.6.

Organizations using forked or derivative code based on the affected versions must ensure their custom implementations are patched to incorporate the new fixes. The advisory recommends upgrading to the latest version immediately to mitigate the risk of exploitation.

What should you do?

If upgrading is not immediately possible, AWS advises deploying devices on isolated network segments where rogue Router Advertisement packets cannot be injected. This network segmentation limits the ability of local attackers to send the crafted packets required to exploit the vulnerabilities.

Security teams should verify their current FreeRTOS-Plus-TCP version against the affected ranges listed in the bulletin. Those maintaining embedded devices should prioritize patching to versions 4.2.6 or 4.4.1 as soon as feasible.

What to do and how to stay safe: AWS

• Audit all systems to identify those running FreeRTOS-Plus-TCP versions 4.0.0 through 4.4.0.
• Upgrade affected systems to FreeRTOS-Plus-TCP version 4.2.6 or 4.4.1 to apply the official patches for CVE-2026-7425 and CVE-2026-7426.
• Isolate vulnerable devices on separate network segments to prevent local attackers from injecting malicious Router Advertisement packets.
• Review any custom or forked versions of the FreeRTOS-Plus-TCP stack to ensure they include the necessary bounds-checking fixes.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE IDs are associated with the FreeRTOS-Plus-TCP vulnerabilities?

The vulnerabilities are identified as CVE-2026-7425 and CVE-2026-7426.

Do attackers need authentication to exploit these flaws?

No, the advisory states that no authentication or user interaction is required for exploitation.

What versions of FreeRTOS-Plus-TCP are not affected?

Versions 4.2.6 and 4.4.1 contain the fixes and are not affected by these specific vulnerabilities.