CVE-2026-7423 Details
Description
Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB. To mitigate this issue, users should upgrade to the fixed version when available.
A denial-of-service vulnerability has been identified in FreeRTOS-Plus-TCP versions 4.0.0 through 4.2.5 and 4.3.0 through 4.4.0. The issue arises from an integer underflow in the ICMP and ICMPv6 echo reply handlers. When outgoing ping support is enabled, an adjacent network user can cause a device crash. This occurs because header sizes are subtracted from a packet length field without proper validation, leading to a heap out-of-bounds read of up to approximately 65KB. The vulnerability can be exploited when the default IP header validation is bypassed, causing devices with memory protection to crash.
Users should upgrade to FreeRTOS-Plus-TCP versions 4.2.6 or 4.4.1, and ensure any forked or derivative code is patched to incorporate the new fixes. Instructions for downloading these versions are available on the FreeRTOS GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://aws.amazon.com/security/security-bulletins/2026-021-aws/ | AMZN | Vendor Advisory |
| https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6 | AMZN | Release Notes |
| https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1 | AMZN | Release Notes |
| https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-7r59-2pgv-9v2r | AMZN | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | AMZN |
Affected Products
| Product | Versions |
|---|---|
| amazon freertos-plus-tcp | >= 4.0.0, < 4.2.6 >= 4.3.0, < 4.4.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | AMZN |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | Initial Analysis | [email protected] |
| Apr 29, 2026 | New CVE Received | AMZN |