---
id: CVE-2026-119086
title: Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel
summary: >-
  Missing queue-set type validation in the queue-set selection system call in
  FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled
  allows a local unprivileged task to write actor-controlled data beyond a
  pointer-size…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-843
  - CWE-121
vendor: FreeRTOS
product: FreeRTOS-Kernel
affected:
  - FreeRTOS-Kernel >= 7.4.0 <= 11.3.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T20:04:17.162661Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T20:04:33.929Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119086'
references:
  - url: 'https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.3'
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-158-aws/'
  - url: >-
      https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-56j9-g43f-8g6v
tags:
  - cve.org
epss: 0.00155
epssPercentile: 0.04687
ingestedAt: '2026-11-05T16:24:31.448Z'
---

## Overview

Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary.



To remediate this issue, users should upgrade to FreeRTOS-Kernel V11.3.3, rebuild, and reflash affected firmware. Builds that do not enable queue sets are not affected.

## Affected

- `FreeRTOS-Kernel >= 7.4.0 <= 11.3.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.