CVE-2026-109588High· 8.8▾ TwilightNumeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enab…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
Last analysed / modified upstream
0.1% → 0.2%
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call.
To remediate this issue, users should upgrade to version V11.3.2 or later.
FreeRTOS-Kernel >= 11.3.0 <= 11.3.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109587High· 8.8Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel
CVE-2021-4034High· 7.8A local privilege escalation vulnerability was found on polkit's pkexec utility
CVE-2024-9143Medium· 4.3Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an applicat…
CVE-2022-35260Medium· 6.5curl can be told to parse a `.netrc` file for credentials
CVE-2022-1304High· 7.8An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5
CVE-2021-3517High· 8.6There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11