CVE-2026-119086 in FreeRTOS
Summary
by MITRE • 10/30/2026
Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary.
To remediate this issue, users should upgrade to FreeRTOS-Kernel V11.3.3, rebuild, and reflash affected firmware. Builds that do not enable queue sets are not affected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in FreeRTOS-Kernel prior to version 11.3.3 represents a critical failure in memory safety enforcement within the operating system's inter-task communication mechanisms. Specifically, the defect resides in the implementation of the queue-set selection system call on Memory Protection Unit enabled ports where queue sets are actively utilized. In embedded systems utilizing an MPU, strict isolation boundaries exist between unprivileged application tasks and privileged kernel space to prevent unauthorized access or modification of critical system resources. The absence of proper validation for the queue-set type allows a local unprivileged task to exploit this logic flaw, resulting in a buffer overflow condition that extends beyond the bounds of a pointer-sized object on the privileged kernel stack. This is not merely an application-level crash but a fundamental breach of the hardware-enforced security model provided by the MPU.
From a technical perspective, the core issue stems from insufficient input validation during the processing of queue-set operations. When an unprivileged task invokes the relevant system call to interact with a queue set, the kernel fails to verify that the type and structure of the data being passed are consistent with expectations for privileged stack manipulation. Consequently, actor-controlled data is written into memory locations that reside on the kernel stack, which operates at a higher privilege level than the calling task. This write operation exceeds the allocated space for pointer-sized objects, leading to an out-of-bounds write. Because this occurs within the context of the MPU-enabled architecture, the attack effectively bypasses the isolation boundary, allowing the unprivileged code to read or modify privileged memory regions that should remain inaccessible.
The operational impact of this vulnerability is severe, as it compromises the integrity and confidentiality of the entire embedded system. An attacker who can execute arbitrary code within an unprivileged task context can leverage this flaw to escalate privileges by manipulating kernel stack data. This could lead to complete control over the microcontroller, enabling actions such as disabling security features, exfiltrating sensitive cryptographic keys stored in privileged memory, or injecting malicious logic into the boot process. The ability to write beyond a pointer-sized object suggests that adjacent variables on the kernel stack can be overwritten, potentially allowing for return-oriented programming attacks or direct modification of control flow data structures within the operating system itself. This undermines the fundamental trust model upon which secure embedded deployments rely.
In terms of industry classification standards, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and CWE-787 Out-of-bounds Write. The exploitation technique involves bypassing access controls to reach privileged memory, which corresponds to ATT&CK tactic T1068 Exploitation for Privilege Escalation. Furthermore, the specific mechanism of writing beyond allocated bounds on a stack can be categorized under CWE-121 Stack-based Buffer Overflow. These classifications highlight the severity of the flaw as it violates both data integrity and access control principles mandated by secure coding standards such as MISRA C or CERT C guidelines for embedded systems.
To remediate this issue, organizations must upgrade their FreeRTOS-Kernel implementation to version 11.3.3 or later. This update includes the necessary validation logic to ensure that queue-set types are correctly verified before any privileged stack operations are performed. Following the upgrade, it is imperative to rebuild and reflash all affected firmware images to apply these security patches. It is important to note that builds which do not enable queue sets are not susceptible to this specific vulnerability due to the absence of the affected code path. However, given the critical nature of kernel-level memory safety in MPU-enabled environments, maintaining up-to-date operating system components remains a fundamental requirement for securing embedded IoT and industrial control systems against privilege escalation attacks.