CVE-2026-77237

Katalog CVE

CVSS 8.4 · High EPSS 0,18%

Kerentanan Out-of-bounds Read pada amazon freertos. Skor CVSS 3.1 8.4 (High) menurut NVD.

Deskripsi (NVD)

Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSE_QUEUE_SETS=1 to read privileged kernel memory. To remediate this issue, users should upgrade to version 11.3.1 or later.

Rincian

Terbit di NVD

21 Agustus 2026

Terakhir diubah

25 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.4 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/2026-086-aws/ advisory vendor
• https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-9wvc-hqvx-5wf5 advisory vendor
• https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.1 release notes