CVE-2026-7423

Received Received - Intake

Integer Underflow in FreeRTOS-Plus-TCP Echo Reply Handlers

Publication date: 2026-04-29

Last updated on: 2026-05-04

Assigner: AMZN

Description

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB. To mitigate this issue, users should upgrade to the fixed version when available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-29

Last Modified

2026-05-04

Generated

2026-07-28

AI Q&A

2026-04-29

EPSS Evaluated

2026-07-26

NVD

CVE-2026-7423

EUVD

EUVD-2026-26276

Affected Vendors & Products

Vendor	Product	Version / Range
amazon	freertos-plus-tcp	From 4.0.0 (inc) to 4.2.6 (exc)
amazon	freertos-plus-tcp	From 4.3.0 (inc) to 4.4.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP versions before V4.4.1 and V4.2.6.

It occurs because header sizes are subtracted from a packet length field without checking if the field is large enough, which leads to a heap out-of-bounds read of up to approximately 65KB.

An adjacent network user can exploit this issue to cause a denial of service by crashing the device when outgoing ping support is enabled.

Detection Guidance

This vulnerability is triggered by crafted ICMP or ICMPv6 echo reply packets when outgoing ping support is enabled (ipconfigSUPPORT_OUTGOING_PINGS setting). Detection involves monitoring for unusual or malformed ICMP echo reply packets that could cause an integer underflow.

Since the vulnerability involves an integer underflow caused by packets with packet length fields smaller than header sizes, network detection tools could be configured to alert on ICMP echo replies with suspiciously small or malformed length fields.

Specific commands to detect this vulnerability are not provided in the available resources.

Impact Analysis

This vulnerability can cause a denial of service by crashing the affected device.

An attacker on an adjacent network can exploit this issue to trigger a device crash, potentially disrupting network operations or device availability.

Compliance Impact

The vulnerability primarily causes a denial of service (device crash) due to an integer underflow in the ICMP and ICMPv6 echo reply handlers when outgoing ping support is enabled.

There is no information provided in the available context or resources about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this issue, users should upgrade to the fixed version of FreeRTOS-Plus-TCP, specifically version V4.4.1 or V4.2.6 or later.

Hi! I’m here to help you understand CVE-2026-7423. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70