AWS FreeRTOS-Plus-TCP up to 4.2.5/4.4.0 Packet Length integer underflow

Summaryinfo

A vulnerability categorized as problematic has been discovered in AWS FreeRTOS-Plus-TCP up to 4.2.5/4.4.0. Impacted is an unknown function of the component Packet Length Handler. Such manipulation leads to integer underflow. This vulnerability is referenced as CVE-2026-7423. The attack needs to be initiated within the local network. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in AWS FreeRTOS-Plus-TCP up to 4.2.5/4.4.0. Affected by this issue is an unknown functionality of the component Packet Length Handler. The manipulation with an unknown input leads to a integer underflow vulnerability. Using CWE to declare the problem leads to CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. Impacted is availability. CVE summarizes:

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB. To mitigate this issue, users should upgrade to the fixed version when available.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-7423 since 04/29/2026. The exploitation is known to be difficult. The attack can only be done within the local network. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 4.2.6 or 4.4.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-26276). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• AWS

Name

• FreeRTOS-Plus-TCP

Version

• 4.0
• 4.1
• 4.2
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.3
• 4.4.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion