CVE-2026-7426CWE-787

Out-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP

Medium · published April 29, 2026

CVSS v4.0
6.1
EPSS
0%
Percentile
33.1
In the wild
Unconfirmed
What it is

Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause memory corruption by sending a crafted Router Advertisement with a prefix length value exceeding the maximum valid length, resulting in a heap buffer overflow. Users processing IPv4 RA only are not impacted.

To mitigate this issue, users should upgrade to the fixed version when available.

The record
Technical detail
CVSS v4.0
6.1 · MEDIUM
Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00400 · 33.1th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-04-29T18:53Z
EPSS history
Timeline
  • 29 APR 18:53Z
    Out-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP
    cvelistv5