← Back to CVE Explorer

CVE-2026-7425

Full vulnerability record from the local CVENow database.

Description

Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option that is smaller than the expected structure size. To mitigate this issue, users should upgrade to the fixed version when available.

Severity
MEDIUM
CVSS score
6.0 (v4.0)
Vulnerability status
Analyzed
Source identifier
ff89ba41-3aa1-4d27-914a-91399e9639e5
Published
2026-04-29 20:16:32.010000
Last modified
2026-10-26 20:10:00.160000
View original CVE JSON 
{
  "id": "CVE-2026-7425",
  "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
  "published": "2026-04-29T20:16:32.010",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option that is smaller than the expected structure size.\n\n\n\nTo mitigate this issue, users should upgrade to the fixed version when available."
    },
    {
      "lang": "es",
      "value": "Validación insuficiente de la longitud de la opción en el analizador de anuncios de router IPv6 en FreeRTOS-Plus-TCP anterior a las versiones V4.2.6 y V4.4.1 permite a un actor de red adyacente causar una denegación de servicio (caída del dispositivo) enviando un anuncio de router manipulado con una opción PREFIX_INFORMATION truncada que es más pequeña que el tamaño de estructura esperado.\n\nPara mitigar este problema, los usuarios deberían actualizar a la versión corregida cuando esté disponible."
    }
  ],
  "affected": [
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "affectedData": [
        {
          "vendor": "AWS",
          "product": "FreeRTOS-Plus-TCP",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP",
          "versions": [
            {
              "version": "4.0.0",
              "lessThan": "4.2.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.3.0",
              "lessThan": "4.4.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.2.6",
              "status": "unaffected"
            },
            {
              "version": "4.4.1",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-29T19:32:41.101290Z",
          "id": "CVE-2026-7425",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.2.6",
              "matchCriteriaId": "DE7A5C38-9CEA-461B-9272-3B8BFC06BFEE"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.3.0",
              "versionEndExcluding": "4.4.1",
              "matchCriteriaId": "375C7032-9CFB-480C-BFFA-029C985A82B7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://aws.amazon.com/security/security-bulletins/2026-023-aws/",
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6",
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1",
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-gffr-xgjg-jh9j",
      "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}