Authorization Flaw in FreeRTOS Kernel Affects Arm Cortex-R82 by Arm
CVE-2026-109587

9.3CRITICAL

Key Information:

Vendor

Freertos

Status
Freertos-kernel
Vendor
CVE Published:
16 October 2026

What is CVE-2026-109587?

An authorization flaw exists in the Arm Cortex-R82 MPU port of FreeRTOS Kernel versions V11.3.0 and V11.3.1, which may permit unprivileged tasks in MPU-enabled builds to access and manipulate privileged kernel memory beyond their allocated regions. This compromise arises from a buffer argument passed during a system call interacting with the MPU, potentially leading to unauthorized data exposure or manipulation. Users are urged to upgrade to version V11.3.2 or later to mitigate this vulnerability.

Affected Version(s)

FreeRTOS-Kernel 11.3.0 <= 11.3.1

References

https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/...
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory
https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advi...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ada Logics Ltd
Anthropic
.