FreeRTOS-Plus-TCP Fixes Unauthenticated IPv6 RA Out-of-Bounds Read and Write Flaws in 4.4.1

AWS published bulletin 2026-023-AWS on April 29, 2026, detailing two memory safety vulnerabilities in the FreeRTOS-Plus-TCP open source TCP/IP stack. The issues, tracked as CVE-2026-7425 and CVE-2026-7426, reside in the IPv6 Router Advertisement option parser. Insufficient validation of length fields in this component allows memory operations without proper bounds checking, creating conditions for out-of-bounds read and out-of-bounds write errors.

The risk

The out-of-bounds read flaw (CVE-2026-7425) and the out-of-bounds write flaw (CVE-2026-7426) can be triggered by any device on the local network. An attacker does not need authentication credentials or user interaction to exploit these defects. Sending crafted Router Advertisement packets is sufficient to trigger the memory safety issues. This means that any device capable of transmitting IPv6 packets on the same network segment can potentially compromise the integrity of the target system.

Who is exposed

Organizations using FreeRTOS-Plus-TCP versions 4.0.0 through 4.2.5 and versions 4.3.0 through 4.4.0 are exposed to these vulnerabilities. The stack provides a standard Berkeley sockets interface and supports essential networking protocols including IPv6, ARP, DHCP, DNS, and Router Advertisement. Any embedded device or IoT product relying on these specific versions of the stack for network connectivity is at risk if connected to a network where untrusted devices can inject traffic.

Cost and compliance

AWS classifies this bulletin as important and requiring attention. The company credits Espilon for collaborating on the issue through the coordinated vulnerability disclosure process. No financial penalties or specific regulatory compliance impacts are mentioned in the advisory. The primary operational cost involves the effort required to verify installed versions and apply the necessary software updates to maintain secure memory handling in network protocol processing.

What to watch

Security teams should verify whether any embedded systems in their environment are running affected versions of FreeRTOS-Plus-TCP. If upgrading is not immediately possible, AWS recommends deploying devices on isolated network segments where rogue Router Advertisement packets cannot be injected. Monitoring network traffic for unexpected or malformed IPv6 RA packets can provide early warning of attempted exploitation against vulnerable parsers.

Signals worth monitoring

Teams usually look for unexpected memory access violations or crashes in embedded device logs following network activity. Check whether intrusion detection systems flag malformed IPv6 packets or unusual Router Advertisement frequencies from local sources. Look for anomalies in system behavior such as unexplained reboots or connectivity drops that coincide with network traffic spikes. Investigate any processes that terminate unexpectedly after handling network data. Review firewall logs for internal devices sending RA packets to segments where they should not originate. Assess whether segmentation controls are preventing unauthorized devices from broadcasting on critical network interfaces.

Background: Out-of-bounds write vulnerabilities

An out-of-bounds write occurs when software places data beyond its allocated memory space. This corruption can let attackers hijack the program’s flow. You reduce risk by using modern languages, applying patches quickly, and limiting what each application can access on your system.

Read the full guide: Out-of-Bounds Write Vulnerabilities Explained: How Memory Errors Break Software

What to do and how to stay safe: FreeRTOS-Plus-TCP

• Inventory all embedded devices to identify those running FreeRTOS-Plus-TCP versions 4.0.0 through 4.4.0.
• Upgrade affected systems to version 4.4.1 or 4.2.6 once the vendor provides the update.
• Isolate vulnerable devices on separate network segments to prevent injection of rogue RA packets.
• Monitor network traffic for malformed IPv6 Router Advertisement packets as a temporary mitigation.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE IDs are associated with these FreeRTOS-Plus-TCP vulnerabilities?

The vulnerabilities are identified as CVE-2026-7425 and CVE-2026-7426.

Do attackers need authentication to exploit these flaws?

No, exploitation requires no authentication or user interaction, only local network access.

What versions of FreeRTOS-Plus-TCP are patched?

The issues are addressed in FreeRTOS-Plus-TCP version V4.4.1 and V4.2.6.