Buffer Truncation Vulnerability in FreeRTOS-Kernel by Amazon Web Services
CVE-2026-109588

9.3CRITICAL

Key Information:

Vendor

Freertos

Status
Freertos-kernel
Vendor
CVE Published:
16 October 2026

What is CVE-2026-109588?

The FreeRTOS-Kernel versions V11.3.0 and V11.3.1 contain a buffer truncation flaw within the MPU buffer authorization check. This vulnerability could allow an unprivileged task in MPU-enabled builds to access privileged kernel memory outside the authorized buffer area when executing a stream buffer system call. To mitigate this risk, users are advised to upgrade to FreeRTOS-Kernel version V11.3.2 or higher.

Affected Version(s)

FreeRTOS-Kernel 11.3.0 <= 11.3.1

References

https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/...
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-1...
vendor-advisory
https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advi...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ada Logics Ltd
Anthropic
.