Incorrect authorization in FreeRTOS - CVE-2026-77234
Published: August 25, 2026
Vulnerability identifier: #VU145360
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-77234
CWE-ID: CWE-863
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to improper input validation in the software timer command path when handling timer commands in FreeRTOS MPU configurations with software timers enabled. A local user can submit a crafted timer command to execute arbitrary code.
Exploitation can bypass MPU-enforced task isolation by causing the privileged timer service task to execute a caller-supplied function in a privileged kernel context.
Affected software
FreeRTOS
How to mitigate CVE-2026-77234
Install security update from vendor's website.
FreeRTOS - update to 11.3.1