CVE-2026-7426
Full vulnerability record from the local CVENow database.
Description
Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause memory corruption by sending a crafted Router Advertisement with a prefix length value exceeding the maximum valid length, resulting in a heap buffer overflow. Users processing IPv4 RA only are not impacted. To mitigate this issue, users should upgrade to the fixed version when available.
Severity
MEDIUM
CVSS score
6.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
ff89ba41-3aa1-4d27-914a-91399e9639e5
Published
2026-04-29 20:16:32.143000
Last modified
2026-10-26 20:10:00.160000
View original CVE JSON
{
"id": "CVE-2026-7426",
"sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"published": "2026-04-29T20:16:32.143",
"lastModified": "2026-10-26T20:10:00.160",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause memory corruption by sending a crafted Router Advertisement with a prefix length value exceeding the maximum valid length, resulting in a heap buffer overflow. Users processing IPv4 RA only are not impacted.\n\n\n\nTo mitigate this issue, users should upgrade to the fixed version when available."
},
{
"lang": "es",
"value": "Validación insuficiente del campo de longitud de prefijo en el procesamiento de anuncios de router IPv6 en FreeRTOS-Plus-TCP anterior a V4.2.6 y V4.4.1 permite a un actor de red adyacente causar corrupción de memoria al enviar un anuncio de router manipulado con un valor de longitud de prefijo que excede la longitud máxima válida, lo que resulta en un desbordamiento de búfer de pila. Los usuarios que procesan solo RA de IPv4 no se ven afectados.\n\nPara mitigar este problema, los usuarios deberían actualizar a la versión corregida cuando esté disponible."
}
],
"affected": [
{
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"affectedData": [
{
"vendor": "AWS",
"product": "FreeRTOS-Plus-TCP",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP",
"versions": [
{
"version": "4.0.0",
"lessThan": "4.2.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.3.0",
"lessThan": "4.4.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.2.6",
"status": "unaffected"
},
{
"version": "4.4.1",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-29T19:33:03.058186Z",
"id": "CVE-2026-7426",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.0.0",
"versionEndExcluding": "4.2.6",
"matchCriteriaId": "DE7A5C38-9CEA-461B-9272-3B8BFC06BFEE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:amazon:freertos-plus-tcp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.3.0",
"versionEndExcluding": "4.4.1",
"matchCriteriaId": "375C7032-9CFB-480C-BFFA-029C985A82B7"
}
]
}
]
}
],
"references": [
{
"url": "https://aws.amazon.com/security/security-bulletins/2026-023-aws/",
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.2.6",
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.1",
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-97qg-4359-xm3x",
"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"tags": [
"Patch",
"Vendor Advisory"
]
}
]
}