FreeRTOS has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was October 2026 with 4. The median CVSS is 8.3 (high). Most affected products: FreeRTOS-Kernel (2), FreeRTOS-Plus-TCP (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.3
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- FreeRTOS-Kernel 2
- FreeRTOS-Plus-TCP 2
Worst active — by depth score
CVE-2026-109588High· 8.8Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel48CVE-2026-109587High· 8.8Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel48CVE-2026-102551High· 7.7Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling42CVE-2026-102552Medium· 5.9Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver32
FreeRTOS vulnerabilities
CVEs affecting FreeRTOS, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-109587High· 8.8Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel
Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigne…
CVE-2026-109588High· 8.8Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enab…
CVE-2026-102551High· 7.7Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling
Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link p…
CVE-2026-102552Medium· 5.9Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver
Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. …