CVE-2026-7424: FreeRTOS-Plus-TCP DHCPv6 DoS Vulnerability

CVE-2026-7424 Overview

An integer underflow vulnerability exists in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before versions V4.4.1 and V4.2.6. This vulnerability allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times. Additionally, it can cause a denial of service condition resulting in a permanent IP task freeze that requires a hardware reset to recover. The vulnerability can be triggered by sending a single crafted DHCPv6 packet to the target device.

The issue is present whenever DHCPv6 functionality is enabled on the device, making it a significant concern for IoT and embedded systems utilizing FreeRTOS networking capabilities.

Critical Impact
Adjacent network attackers can cause permanent device lockup requiring hardware reset and corrupt critical network configuration with a single malicious DHCPv6 packet.

Affected Products

FreeRTOS-Plus-TCP versions prior to V4.4.1
FreeRTOS-Plus-TCP versions prior to V4.2.6
All devices with DHCPv6 enabled running vulnerable FreeRTOS-Plus-TCP versions

Discovery Timeline

April 29, 2026 - CVE-2026-7424 published to NVD
April 29, 2026 - Last updated in NVD database

Technical Details for CVE-2026-7424

Vulnerability Analysis

This vulnerability is classified as CWE-191 (Integer Underflow), a memory corruption vulnerability that occurs in the DHCPv6 sub-option parsing logic of FreeRTOS-Plus-TCP. When the DHCPv6 parser processes incoming packets, it performs arithmetic operations on length fields without proper bounds checking. An attacker can craft a DHCPv6 packet with malicious sub-option length values that cause an integer underflow condition.

When the underflow occurs, the parser interprets the resulting large unsigned value as a valid length, leading to memory corruption. This corruption affects critical network state including IPv6 address assignments, DNS server configurations, and DHCP lease timing data. The most severe consequence is a complete freeze of the IP task, which cannot recover without a full hardware reset of the affected device.

Root Cause

The root cause of this vulnerability lies in insufficient validation of sub-option length fields in the DHCPv6 packet parser. When calculating buffer boundaries or remaining data lengths, the code performs subtraction operations without first verifying that the length value being subtracted is not larger than the available data size. This allows an attacker-controlled length field to cause an integer underflow, resulting in a wrap-around to a very large positive value.

This is a classic integer underflow scenario where unsigned integer arithmetic produces unexpected results when the subtraction would mathematically result in a negative number. The affected code path does not include guards to prevent this condition, nor does it validate that sub-option lengths are consistent with the overall packet structure.

Attack Vector

The attack is executed from an adjacent network position, meaning the attacker must have Layer 2 network access to reach the target device. The attack requires no authentication or user interaction and can be performed with low complexity.

An attacker crafts a DHCPv6 packet containing malicious sub-option fields with carefully calculated length values designed to trigger the integer underflow. When the vulnerable device receives and processes this packet, the underflow occurs in the parsing routine. The corrupted length value causes the parser to read or write beyond intended memory boundaries, corrupting the device's IPv6 configuration state. In the most severe case, this corruption causes the IP networking task to enter a permanent frozen state, effectively taking the device offline until it is physically reset.

Since the attack only requires a single crafted packet, it can be executed rapidly against multiple devices on the same network segment. Devices running FreeRTOS-Plus-TCP with DHCPv6 enabled in environments such as industrial IoT, medical devices, or embedded systems are particularly at risk.

Detection Methods for CVE-2026-7424

Indicators of Compromise

Unexpected device resets or unresponsive network interfaces on FreeRTOS-based devices
Corrupted IPv6 address assignments or DNS configurations on embedded devices
DHCPv6 packets with abnormally large or malformed sub-option length fields on the network
Devices entering frozen states that require hardware reset to recover

Detection Strategies

Implement network monitoring to detect DHCPv6 packets with anomalous sub-option lengths that could indicate exploitation attempts
Deploy intrusion detection signatures for malformed DHCPv6 packets targeting the adjacent network segment
Monitor device availability and implement alerting for devices that become unresponsive or require unexpected resets
Conduct firmware inventory audits to identify devices running vulnerable FreeRTOS-Plus-TCP versions

Monitoring Recommendations

Enable DHCPv6 packet inspection at network switches or dedicated monitoring points to identify malformed packets
Implement device health monitoring to detect IP task freezes or network stack failures on FreeRTOS devices
Log and alert on any devices that require hardware resets, as this may indicate exploitation of this vulnerability
Regularly audit network segments for unauthorized devices that could be positioned for adjacent network attacks

How to Mitigate CVE-2026-7424

Immediate Actions Required

Upgrade FreeRTOS-Plus-TCP to version V4.2.6 or V4.4.1 or newer immediately
Identify all devices in your environment running vulnerable FreeRTOS-Plus-TCP versions with DHCPv6 enabled
Consider disabling DHCPv6 functionality on affected devices until patches can be applied if IPv6 autoconfiguration is not required
Implement network segmentation to limit adjacent network access to vulnerable devices

Patch Information

The FreeRTOS project has released patched versions that address this integer underflow vulnerability. Users should upgrade to:

Version V4.2.6: Available from the GitHub Release V4.2.6
Version V4.4.1: Available from the GitHub Release V4.4.1

Additional details are available in the GitHub Security Advisory GHSA-wrhm-c99p-2p8g and the AWS Security Bulletin 2026-022.

Workarounds

Disable DHCPv6 functionality on affected devices and configure static IPv6 addresses where operationally feasible
Implement network access controls to restrict which devices can send DHCPv6 traffic to vulnerable systems
Deploy network-layer filtering to drop malformed DHCPv6 packets before they reach vulnerable devices
Isolate vulnerable devices on dedicated network segments with strict access controls until patching is complete

bash

# Example: Verify FreeRTOS-Plus-TCP version in firmware
# Check your device's firmware configuration or build system for version information
# Ensure ipconfigUSE_DHCPv6 is set to 0 to disable DHCPv6 as a temporary workaround

# In FreeRTOSIPConfig.h, set:
# #define ipconfigUSE_DHCPv6    0