Memory Access Vulnerability in FreeRTOS Kernel by Amazon Web Services
CVE-2026-77237

8.2HIGH

Key Information:

Vendor

Freertos

Status
Freertos-kernel
Vendor
CVE Published:
21 August 2026

What is CVE-2026-77237?

In the FreeRTOS Kernel, prior to version 11.3.1, a vulnerability exists due to missing queue-set type validation in the function xQueueAddToSet(). This flaw may permit unprivileged tasks operating on MPU-enabled ports, when configured with configUSE_QUEUE_SETS=1, to access and read memory that is intended to be restricted to privileged kernel operations. Users are strongly advised to upgrade to version 11.3.1 or later to mitigate this security risk.

Affected Version(s)

FreeRTOS-Kernel 7.4.0 <= 11.3.0

References

https://github.com/FreeRTOS/FreeRTOS-Kernel/tree/11.3.1
patch
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NVIDIA
.