FreeRTOS-Plus-TCP 4.4.1, 4.2.6 Patch Remote IPv6 RA Parsers Vulnerable to CVE-2026-7425, 7426

AWS released security updates for FreeRTOS-Plus-TCP to address two memory safety vulnerabilities. The patches fix out-of-bounds read and write issues in the IPv6 Router Advertisement parser that could be exploited by local network devices.

What happened

AWS disclosed two vulnerabilities, CVE-2026-7425 and CVE-2026-7426, in FreeRTOS-Plus-TCP on April 29, 2026. These flaws exist in the component responsible for parsing IPv6 Router Advertisement options. The underlying cause is insufficient validation of length fields, which permits memory operations without proper bounds checking.

One vulnerability results in an out-of-bounds read, while the other allows an out-of-bounds write. Any device on the same local network can exploit these issues by sending crafted Router Advertisement packets. No authentication or user interaction is required for successful exploitation. The vulnerabilities were identified through a coordinated disclosure process involving Espilon.

Why it matters

Impacted software includes FreeRTOS-Plus-TCP versions 4.0.0 through 4.2.5 and versions 4.3.0 through 4.4.0. Because the flaws allow exploitation from the local network, exposed embedded devices are at risk. Attackers do not need credentials to trigger the memory corruption. AWS has addressed these issues in FreeRTOS-Plus-TCP version 4.4.1 and version 4.2.6. Organizations using forked or derivative code must manually incorporate the new fixes.

What to watch

• Verify current FreeRTOS-Plus-TCP versions against the affected ranges.
• Monitor network segments for unusual Router Advertisement traffic patterns.
• Check for confirmation of patch application in embedded device logs.
• Ensure derivative codebases have been updated with the vendor's fixes.

Who needs to act first

Teams should prioritize updating systems that are directly connected to untrusted local networks or shared Wi-Fi segments. Exposure is highest for devices that process network traffic without strict segmentation. Roll out the verified patches to production environments after testing in isolated labs to ensure stability. If immediate updating is not feasible, isolate affected devices from the broader network to prevent injection of malicious Router Advertisement packets. Maintain backups of current configurations before applying changes to facilitate rollback if integration issues arise.

What to do and how to stay safe: AWS

• Identify all devices running FreeRTOS-Plus-TCP versions 4.0.0 through 4.4.0.
• Apply the available patches to reach version 4.4.1 or 4.2.6.
• Isolate vulnerable devices on separate network segments until patched.
• Review network logs for signs of crafted Router Advertisement packets.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVEs are addressed in this update?

The update addresses CVE-2026-7425 and CVE-2026-7426.

Is user interaction required for exploitation?

No, exploitation requires no authentication or user interaction.

What mitigation is available if patching is delayed?

Deploy devices on isolated network segments where rogue RA packets cannot be injected.