CVE-2026-7423

Katalog CVE

CVSS 6.5 · Medium EPSS 0,36%

Kerentanan Integer Underflow (Wrap or Wraparound) pada amazon freertos-plus-tcp. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB. To mitigate this issue, users should upgrade to the fixed version when available.

Rincian

Terbit di NVD

29 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-191: Integer Underflow (Wrap or Wraparound)

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/2026-021-aws/ advisory vendor
• https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-7r59-2pgv-9v2r patch · advisory vendor
• https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6 release notes
• https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1 release notes