CVE-2026-119086Medium· 6.5▾ SunlitMissing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-size…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary.
To remediate this issue, users should upgrade to FreeRTOS-Kernel V11.3.3, rebuild, and reflash affected firmware. Builds that do not enable queue sets are not affected.
FreeRTOS-Kernel >= 7.4.0 <= 11.3.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109587High· 8.8Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel
CVE-2026-109588High· 8.8Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel
CVE-2026-102551High· 7.7Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling
CVE-2026-102552Medium· 5.9Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver
CVE-2026-0719High· 8.6A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication
CVE-2023-20577High· 7.4A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.