AWS Security Bulletins

Issue with FreeRTOS-Plus-TCP - IPv6 Router Advertisement Memory Safety Issues

Bulletin ID: 2026-023-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/04/29 12:30 PM PDT Description: FreeRTOS-Plus-TCP is an open source TCP/IP stack implementation designed for FreeRTOS, providing a standard Berkeley sockets interface and support for essential networking protocols including IPv6, ARP, DHCP, DNS, and Router Advertisement (RA). We identified CVE-2026-7425 and CVE-2026-7426, one of them being out-of-bounds read and another one being out-of-bounds write issues respectively in the IPv6 Router Advertisement option parser where insufficient validation of length fields allows memory operations without proper bounds checking. Either issue can be exploited by any device on the local network that can send crafted Router Advertisement packets. No authentication or user interaction is required. Impacted versions: >=V4.0.0 AND =V4.3.0 AND

Read the vendor bulletin

Not listedCVSS not listedNot listed severity

Scope

What the vendor says is affected

The collected bulletin did not provide a separate affected-products list. Check the original bulletin before making an exposure decision.

Update history

What changed in later vendor updates

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

Sep 9, 2026 at 9:30 PM UTC
- The vendor changed the advisory's last-updated date.

Timeline

When this advisory changed

Aug 20, 2026 at 9:50 PM UTC
Added to SecurityAlert
We collected the advisory from the official source.
Sep 9, 2026 at 9:15 PM UTC
Published by AWS
The publication date reported by the vendor.
Sep 9, 2026 at 9:30 PM UTC
Confirmed at the source
Our collector saw this advisory during a later source check.

Vulnerabilities

CVEs named in this advisory

CVE-2026-7425View CVSS, KEV, EPSS, and threat context CVE-2026-7426View CVSS, KEV, EPSS, and threat context

Source

Start with the vendor's bulletin

SecurityAlert organizes the fields the vendor published. The original bulletin remains the source of record for affected versions, fixes, and later changes.

Vendor: AWS
Last source check: Sep 13, 2026 at 5:30 AM UTC

Open the official bulletin How SecurityAlert builds this record

Your environment

Check the systems you actually run

A vendor advisory can tell you what may be affected. It cannot tell you whether that product and version are installed in your environment.

Confirm the product and installed version.
Read the vendor's prerequisites and exceptions.
Test the update or mitigation through your normal change process.

Keep following

Get new AWS advisories

Use the vendor-specific RSS feed or set up alerts for a product your team relies on.

Follow this vendor's RSS feed

What the vendor says is affected

What changed in later vendor updates

When this advisory changed

CVEs named in this advisory

Related advisories from AWS

CVE-2026-89332 - Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2

CVE-2026-18061 - XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

CVE-2026-89065 and CVE-2026-89066: Issue with projen - Path traversal and OS command injection

CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library