SB20260825125 - Multiple vulnerabilities in FreeRTOS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260825125

SB20260825125 - Multiple vulnerabilities in FreeRTOS

Published: August 25, 2026

Security Bulletin ID SB20260825125
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-77237)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in xQueueAddToSet queue-set feature when adding a non-conforming handle to a queue set and performing a later queue-set operation on it. A local user can add a non-conforming handle to a queue set to disclose sensitive information.

Only MPU-enabled builds with queue sets enabled are vulnerable, and the disclosed data is placed into application-readable storage in privileged kernel context.


2) Incorrect authorization (CVE-ID: CVE-2026-77234)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper input validation in the software timer command path when handling timer commands in FreeRTOS MPU configurations with software timers enabled. A local user can submit a crafted timer command to execute arbitrary code.

Exploitation can bypass MPU-enforced task isolation by causing the privileged timer service task to execute a caller-supplied function in a privileged kernel context.


3) Out-of-bounds write (CVE-ID: CVE-2026-77236)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds write in SecureContext_AllocateContext when allocating a secure context with an undersized stack on ARM TrustZone (ARMv8-M) configurations. A local user can request a secure context with an undersized stack to cause a denial of service.

Only ARM TrustZone (ARMv8-M) configurations that use secure contexts are affected.


4) Use-after-free (CVE-ID: CVE-2026-77235)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service and modify secure memory.

The vulnerability exists due to use-after-free in SecureContext_FreeContext when freeing a task\'s secure context while it is still in use. A local user can free a task\'s secure context to cause a denial of service and modify secure memory.

Only ARM TrustZone (ARMv8-M) configurations using TrustZone and MPU secure contexts are affected.


Remediation

Install update from vendor's website.

References