CVE-2026-7425

Received Received - Intake

Denial of Service in FreeRTOS-Plus-TCP IPv6 Router Advertisement Parser

Publication date: 2026-04-29

Last updated on: 2026-05-04

Assigner: AMZN

Description

Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option that is smaller than the expected structure size. To mitigate this issue, users should upgrade to the fixed version when available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-29

Last Modified

2026-05-04

Generated

2026-07-26

AI Q&A

2026-04-29

EPSS Evaluated

2026-07-25

NVD

CVE-2026-7425

EUVD

EUVD-2026-26283

Affected Vendors & Products

Vendor	Product	Version / Range
amazon	freertos-plus-tcp	From 4.0.0 (inc) to 4.2.6 (exc)
amazon	freertos-plus-tcp	From 4.3.0 (inc) to 4.4.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is caused by insufficient validation of the option length in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP versions before V4.2.6 and V4.4.1.

An attacker on an adjacent network can exploit this by sending a specially crafted Router Advertisement message that contains a truncated PREFIX_INFORMATION option smaller than the expected size.

This causes the device to crash, resulting in a denial of service.

Detection Guidance

This vulnerability involves malformed IPv6 Router Advertisement (RA) packets with truncated PREFIX_INFORMATION options. Detection involves monitoring for unusual or malformed RA packets on the local network.

Network administrators can use packet capture and analysis tools such as tcpdump or Wireshark to detect suspicious RA packets.

Use tcpdump to capture IPv6 Router Advertisement packets: tcpdump -i <interface> icmp6 and ip6[40] == 134
Analyze captured packets in Wireshark to inspect the Router Advertisement options, specifically looking for PREFIX_INFORMATION options that are smaller than expected.
Set up network-level filtering or intrusion detection rules to alert on or block malformed RA packets with truncated options.

Since the vulnerability is triggered by crafted RA packets with insufficient length validation, detecting packets with truncated or malformed PREFIX_INFORMATION options is key.

Impact Analysis

The primary impact of this vulnerability is a denial of service condition.

An attacker on the same network can cause the affected device to crash by sending a malformed Router Advertisement message.

This can disrupt device availability and network operations.

Compliance Impact

The vulnerability primarily causes a denial of service (device crash) by processing malformed IPv6 Router Advertisement packets, impacting availability but not confidentiality or integrity.

There is no direct information provided about how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this issue, users should upgrade to the fixed version of FreeRTOS-Plus-TCP when it becomes available.

Hi! I’m here to help you understand CVE-2026-7425. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70