{"id":"CVE-2026-119086","title":"Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel","summary":"Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-size…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-843","CWE-121"],"vendor":"FreeRTOS","product":"FreeRTOS-Kernel","affected":["FreeRTOS-Kernel >= 7.4.0 <= 11.3.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T20:04:17.162661Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T20:04:33.929Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119086","references":[{"url":"https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.3"},{"url":"https://aws.amazon.com/security/security-bulletins/2026-158-aws/"},{"url":"https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-56j9-g43f-8g6v"}],"tags":["cve.org"],"epss":0.00155,"epssPercentile":0.04681,"ingestedAt":"2026-11-05T16:24:31.448Z","slug":"CVE-2026-119086","body":"## Overview\n\nMissing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary.\n\n\n\nTo remediate this issue, users should upgrade to FreeRTOS-Kernel V11.3.3, rebuild, and reflash affected firmware. Builds that do not enable queue sets are not affected.\n\n## Affected\n\n- `FreeRTOS-Kernel >= 7.4.0 <= 11.3.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}